CVE-2026-87235 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker with network access via SSH to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The vulnerability has a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impacts and no impact on availability. Oracle has addressed this vulnerability as part of its September 2026 Critical Security Patch Update, which includes 673 new security patches across various Oracle products, including Oracle Hyperion Financial Management.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by Oracle Hyperion Financial Management. This compromises the confidentiality and integrity of the affected system. There is no reported impact on availability. The vulnerability requires network access via SSH but no authentication, making it a significant risk if the affected version is exposed.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability along with many others. Customers are strongly advised to apply the available security patches without delay and remain on actively supported versions. No additional mitigation steps are specified beyond applying the official patch from Oracle. Patch status is confirmed as available via the Oracle Critical Security Patch Update advisory.