CVE-2026-87229 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical data and unauthorized read access to a subset of accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, reflecting low attack complexity, no privileges required, no user interaction, and impacts on confidentiality (low) and integrity (high) without affecting availability. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, as well as unauthorized read access to some data. This compromises the confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability can be exploited remotely without authentication.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the official Oracle patches promptly to remediate the issue. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.