CVE-2026-87206 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The vulnerability has a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous security patches for Oracle products including this one.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, as well as unauthorized access to all accessible data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability requires network access via HTTP but is difficult to exploit and does not require user interaction or privileges.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying all relevant patches without delay. No additional mitigation steps are indicated beyond applying the official patch.