CVE-2026-87129 is a critical vulnerability in the access and security component of Oracle Hyperion Data Relationship Management version 11.2.26.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle Hyperion Data Relationship Management, compromising confidentiality and integrity. There is no impact on availability. The vulnerability is exploitable remotely without authentication, increasing risk.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly. Oracle recommends remaining on actively-supported versions and applying patches without delay to prevent exploitation. Patch status is confirmed as available via the Oracle advisory.