CVE-2026-87171 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows a remote unauthenticated attacker with network access over HTTPS to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability affects confidentiality and integrity with a CVSS 3.1 base score of 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple Oracle products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, as well as unauthorized access to all accessible data in the product. The vulnerability impacts confidentiality and integrity but does not affect availability. The vulnerability is difficult to exploit and requires network access via HTTPS without authentication. The scope of impact may extend to additional Oracle products due to the nature of the vulnerability.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the security patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond applying the official patch.