CVE-2026-87239 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows a high privileged attacker with network access via HTTP to compromise the system. The vulnerability has a CVSS 3.1 base score of 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update (CSPU), which provides targeted security fixes. Customers are strongly advised to apply the available patches promptly to mitigate this risk.

The vulnerability allows an attacker with high privileges and network access to fully compromise Oracle Hyperion Financial Management version 11.2.26.0.000. This can result in complete takeover of the system, affecting confidentiality, integrity, and availability of the product.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official Oracle patches without delay to remediate this issue. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches. No alternative mitigations or workarounds are indicated in the advisory.