CVE-2026-87217 is a security vulnerability in Oracle Hyperion Financial Management (version 11.2.26.0.000) that permits unauthenticated remote attackers to compromise the product via HTTP. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Hyperion Financial Management. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impacts.

The vulnerability allows unauthenticated remote attackers to gain unauthorized access to critical data, including the ability to create, delete, or modify such data within Oracle Hyperion Financial Management. This can lead to significant data compromise and potential disruption of business processes relying on this data. There is no reported impact on availability.

Oracle has released this vulnerability as part of its September 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.