CVE-2026-87131 is a vulnerability in the Access and Security component of Oracle Hyperion Data Relationship Management version 11.2.26.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, requiring user interaction from a person other than the attacker. Successful exploitation can result in unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete capabilities on some data. The vulnerability has a CVSS 3.1 score of 7.6 with high confidentiality impact and low integrity impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Data Relationship Management. Additionally, attackers may gain unauthorized ability to update, insert, or delete some data. The vulnerability affects confidentiality and integrity but does not impact availability. Exploitation requires network access and user interaction from a third party.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Remaining on actively supported versions and timely patching are recommended. No additional mitigation steps are indicated beyond applying the official patch.