CVE-2026-87226 is a vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. The flaw is exploitable by a low-privileged attacker with network access via HTTP, potentially leading to full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products including Oracle Hyperion Financial Management.

Successful exploitation can result in complete compromise of Oracle Hyperion Financial Management, impacting confidentiality, integrity, and availability of the system. This could allow attackers to gain unauthorized control over the application and potentially access sensitive financial data or disrupt operations.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No additional mitigation steps are specified beyond applying the official patch.