CVE-2026-87204 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows a low privileged attacker with network access via HTTP to exploit the vulnerability without user interaction, resulting in complete compromise of the system. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update.

The vulnerability enables an attacker with low privileges and network access to fully compromise Oracle Hyperion Financial Management, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, modification, and disruption of service.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends staying on actively supported versions and applying patches without delay. No additional mitigation steps are specified beyond applying the official patch.