CVE-2026-87242 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker with network access over TLS to compromise the product, potentially resulting in unauthorized creation, deletion, or modification of critical data or full access to all accessible data. The vulnerability has a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impacts and no impact on availability. The attack complexity is high, and no privileges or user interaction are required for exploitation.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, as well as unauthorized access to all accessible data. This compromises confidentiality and integrity of the data managed by the product. There is no reported impact on availability. The vulnerability is rated high severity with a CVSS score of 7.4.

Oracle has released this vulnerability as part of its September 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch status is confirmed as available via Oracle's official Critical Security Patch Update advisory.