CVE-2026-87182 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. It allows a low privileged attacker with logon access to the infrastructure where the product runs to compromise Oracle Hyperion Financial Management. The vulnerability has a CVSS 3.1 base score of 8.8 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vulnerability can lead to takeover of the product and may affect additional Oracle products due to scope change.

The vulnerability enables a low privileged attacker with logon access to the infrastructure to fully compromise Oracle Hyperion Financial Management, potentially leading to complete takeover of the product. Due to scope change, attacks may also significantly impact other Oracle products. The CVSS score of 8.8 reflects high severity with critical impacts on confidentiality, integrity, and availability.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant patches without delay to mitigate this vulnerability. The vendor advisory emphasizes remaining on actively-supported versions and timely patch application. Patch status is confirmed as available via the Oracle CSPU advisory.