CVE-2026-87208 is a security vulnerability in Oracle Hyperion Financial Management version 11.2.26.0.000 that permits a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting high impact on confidentiality and integrity but no impact on availability. Oracle's September 2026 Critical Security Patch Update includes patches addressing this vulnerability among 673 others across multiple Oracle products.

The vulnerability allows unauthorized access to critical data and unauthorized modification of some data within Oracle Hyperion Financial Management 11.2.26.0.000. This can lead to data confidentiality breaches and integrity violations, potentially compromising sensitive financial information managed by the product.

Oracle has released a Critical Security Patch Update in September 2026 that includes a patch for this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate this risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are specified beyond applying the official patch.