CVE-2026-87228 is a security vulnerability in Oracle Hyperion Financial Management (version 11.2.26.0.000) that permits unauthenticated attackers with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, reflecting high confidentiality and integrity impacts. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains 673 security patches across multiple Oracle products.

Exploitation of this vulnerability can result in unauthorized access to critical data within Oracle Hyperion Financial Management and unauthorized modification (update, insert, delete) of some accessible data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is exploitable remotely without authentication.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using Oracle Hyperion Financial Management version 11.2.26.0.000 should apply the relevant patch promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.