CVE-2026-87218 is a security vulnerability in Oracle Hyperion Financial Management version 11.2.26.0.000. It allows an unauthenticated attacker who has access to the physical communication segment attached to the hardware running the product to compromise it. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data, as well as the ability to cause a hang or repeated crashes leading to denial of service. The CVSS 3.1 vector indicates the attack requires adjacent network access, low attack complexity, no privileges, and no user interaction, with high impact on integrity and availability but no confidentiality impact.

The vulnerability enables unauthorized data manipulation including creation, deletion, or modification of critical data within Oracle Hyperion Financial Management. It also allows attackers to cause denial of service by hanging or crashing the application repeatedly. This compromises the integrity and availability of the system but does not affect confidentiality.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No indication was given that the vulnerability is already mitigated or requires no action.