CVE-2026-87219 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. It allows a low privileged attacker who has logon access to the infrastructure where the product runs to compromise Oracle Hyperion Financial Management. The vulnerability can result in unauthorized creation, deletion, or modification of critical data and unauthorized access to all data accessible by the product. The CVSS 3.1 score is 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), indicating a local attack vector with low complexity and privileges required, no user interaction, scope change, and high confidentiality and integrity impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple Oracle products. Customers are urged to apply the patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of data but does not impact availability. The vulnerability requires local access with low privileges but can have significant impact on data security and integrity.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Hyperion Financial Management version 11.2.26.0.000 promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to mitigate this vulnerability. No additional mitigation steps are specified beyond applying the official patch.