CVE-2026-87234 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows a low privileged attacker with network access via HTTP to compromise the application, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle’s September 2026 Critical Security Patch Update includes patches for this vulnerability, emphasizing the importance of applying these updates promptly.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive financial management data. There is no impact on availability reported. The vulnerability is exploitable remotely over the network with low complexity and requires low privileges, increasing the risk of compromise if unpatched.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the relevant security patches without delay to mitigate the risk. Oracle recommends remaining on actively-supported versions and promptly applying all security updates. No additional mitigation steps are indicated beyond patching.