CVE-2026-87175 is a critical security vulnerability in Oracle Hyperion Financial Management (version 11.2.26.0.000) that permits unauthenticated remote attackers to compromise the product via network access over TCP. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Hyperion Financial Management. The vulnerability has a CVSS 3.1 score of 9.1 with high confidentiality and integrity impacts and no required privileges or user interaction. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Exploitation of this vulnerability allows attackers without authentication to gain unauthorized access to critical data within Oracle Hyperion Financial Management, including the ability to create, delete, or modify data. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability is remotely exploitable over the network without any privileges or user interaction.

Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability. Customers should apply the relevant patches from this update promptly to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the Oracle advisory linked in the vendor content.