CVE-2026-87134 is a vulnerability in the Access and Security component of Oracle Hyperion Data Relationship Management version 11.2.26.0.000. It allows a low privileged attacker with network access via TCP to compromise the product, resulting in unauthorized access to critical data or complete access to all accessible data within Oracle Hyperion Data Relationship Management. The vulnerability has a CVSS 3.1 base score of 7.7 with a vector indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data within Oracle Hyperion Data Relationship Management, potentially compromising confidentiality. The vulnerability affects the confidentiality of data but does not impact integrity or availability. The scope of the vulnerability extends beyond the immediate product, potentially affecting additional Oracle products.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Hyperion Data Relationship Management version 11.2.26.0.000 should apply the provided patch promptly to remediate the vulnerability. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation.