CVE-2026-87170 is a critical security vulnerability in Oracle Hyperion Financial Management (version 11.2.26.0.000) that permits unauthenticated remote attackers to compromise the system via HTTP. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Hyperion Financial Management. The vulnerability has a CVSS 3.1 score of 9.1 with attack vector network, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts.

Exploitation of this vulnerability can result in unauthorized access to critical data and unauthorized modification or deletion of data within Oracle Hyperion Financial Management. This could compromise the confidentiality and integrity of sensitive financial data managed by the product.

Oracle has released a Critical Security Patch Update (CSPU) in September 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the relevant security patches promptly to remediate this vulnerability. The vendor advisory emphasizes the importance of remaining on actively supported versions and applying patches without delay. Patch availability details should be confirmed via the official Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html. No indication that the vulnerability is already mitigated or requires no action was provided.