CVE-2026-87144 is a vulnerability in the access and security component of Oracle Hyperion Data Relationship Management version 11.2.26.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, requiring user interaction from a third party. Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by the product, as well as unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 base score of 7.6, with attack vector network, low attack complexity, low privileges required, and user interaction required. The scope is changed, and confidentiality impact is high, integrity impact is low, and availability impact is none.

Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Hyperion Data Relationship Management. Additionally, attackers can perform unauthorized updates, inserts, or deletions on some data. This compromises confidentiality and integrity of the data managed by the product.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches without delay to remediate this vulnerability. Staying on actively supported versions and promptly applying Oracle's security patches is recommended. Patch status is confirmed as fixed in the Critical Security Patch Update; refer to Oracle's advisory at https://www.oracle.com/security-alerts/cspusep2026.html for patch availability and installation instructions.