CVE-2026-87250 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows a low privileged attacker with network access via HTTP to compromise the product, requiring user interaction from a third party. The vulnerability impacts confidentiality and integrity, enabling unauthorized access to critical data and unauthorized update, insert, or delete operations on some accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, with a base score of 7.6. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted patches for this and many other vulnerabilities across Oracle products.

Successful exploitation can result in unauthorized access to critical data within Oracle Hyperion Financial Management and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity but not availability. The attack requires network access and user interaction from a person other than the attacker. The scope of impact may extend beyond Oracle Hyperion Financial Management to other products. The CVSS score of 7.6 reflects a high severity level.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate this risk. Oracle recommends remaining on actively supported versions and applying patches without delay. No additional mitigation steps are specified beyond applying the official patch.