CVE-2026-87211 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact with no impact on integrity or availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches for various Oracle products, including Oracle Hyperion Financial Management.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Hyperion Financial Management version 11.2.26.0.000. The confidentiality of sensitive information is severely impacted, while integrity and availability remain unaffected.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively-supported versions and applying patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.