CVE-2026-87173 is a critical security vulnerability in Oracle Hyperion Financial Management (version 11.2.26.0.000) that permits unauthenticated remote attackers to compromise the system via network access over TCP. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the product. The vulnerability has a CVSS 3.1 base score of 9.1 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating it is remotely exploitable with low attack complexity, no privileges or user interaction required, and results in high confidentiality and integrity impact.

An attacker can remotely exploit this vulnerability without authentication to gain unauthorized access to critical data within Oracle Hyperion Financial Management. This includes the ability to create, delete, or modify sensitive data, potentially compromising the integrity and confidentiality of the system's data. There is no impact on availability reported.

Oracle has released a Critical Security Patch Update (CSPU) in September 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends staying on actively-supported versions and applying patches without delay. Patch status is confirmed as available via Oracle's Critical Security Patch Update advisory.