CVE-2026-87192 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. The flaw allows a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical data and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 others across multiple products.

Successful exploitation can lead to unauthorized access to critical data within Oracle Hyperion Financial Management and partial denial of service conditions. The confidentiality impact is high, while integrity is not affected, and availability impact is low. This could compromise sensitive financial management data and disrupt service availability partially.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to remediate the issue. Oracle recommends remaining on actively-supported versions and applying patches without delay to prevent exploitation. No indication of alternative mitigations or that the vulnerability is already mitigated without patching is provided.