CVE-2026-87241 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker who has access to the physical communication segment attached to the hardware where the software executes to compromise the system. The attacker can gain unauthorized creation, deletion, or modification access to critical data or full access to all data accessible by the product. The CVSS 3.1 vector indicates the attack requires adjacent network access, low attack complexity, no privileges, and no user interaction, with high confidentiality and integrity impact but no availability impact.

The vulnerability enables unauthorized attackers with physical network segment access to compromise Oracle Hyperion Financial Management, potentially leading to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. This can severely impact data confidentiality and integrity within affected environments.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions. Staying on actively supported versions and timely patching are critical, as Oracle continues to observe attempts to exploit vulnerabilities for which patches exist. No alternative mitigations or temporary fixes are indicated in the advisory.