CVE-2026-87198 is a security vulnerability in Oracle Hyperion Financial Management (version 11.2.26.0.000) that permits an unauthenticated attacker with network access over HTTP to compromise the system. The vulnerability allows unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within Oracle Hyperion Financial Management. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts but no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Hyperion Financial Management. This compromises confidentiality and integrity of the affected system's data. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.4.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.