CVE-2026-87138 is a vulnerability in the Access and Security component of Oracle Hyperion Data Relationship Management version 11.2.26.0.0. It allows an unauthenticated attacker to exploit the SOAP interface remotely to cause a hang or repeated crash, resulting in a complete denial of service. The vulnerability has no impact on confidentiality or integrity but severely impacts availability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high availability impact.

Successful exploitation results in a denial of service condition causing the Oracle Hyperion Data Relationship Management application to hang or crash repeatedly. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely without authentication.

Oracle has included this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches from this update promptly. Oracle recommends remaining on actively-supported versions and applying security patches without delay to mitigate this and other vulnerabilities. Patch availability and installation instructions are provided in the Oracle advisory. No alternative mitigations or workarounds are specified.