CVE-2026-87176 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker with network access to exploit the vulnerability easily, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Financial Management. The vulnerability has a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted high-priority fixes for this and many other vulnerabilities.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.