CVE-2026-87196 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The CVSS 3.1 base score is 8.2, reflecting high confidentiality and integrity impacts with no required privileges or user interaction. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability along with 672 others across multiple Oracle products.

Successful exploitation can lead to unauthorized access to critical data within Oracle Hyperion Financial Management and unauthorized modification (update, insert, delete) of some accessible data. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. The vulnerability is exploitable remotely without authentication, increasing the risk.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.