CVE-2026-87249 is a security vulnerability in Oracle Hyperion Financial Management (version 11.2.26.0.000) that permits an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation requires user interaction from a person other than the attacker. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data and partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability.

The vulnerability allows unauthorized modification of critical data within Oracle Hyperion Financial Management and can cause a partial denial of service. There is no confidentiality impact reported. Exploitation requires user interaction, limiting automated exploitation. The overall impact is high due to integrity compromise and partial availability disruption.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Hyperion Financial Management version 11.2.26.0.000 should apply the relevant patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks.