CVE-2026-87194 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical data or complete access to all data accessible through Oracle Hyperion Financial Management. The vulnerability has a CVSS 3.1 base score of 7.5, with the vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data within Oracle Hyperion Financial Management. The confidentiality of data is severely impacted, but there is no direct impact on integrity or availability. This could expose sensitive financial management data to attackers without requiring authentication.

Oracle has released a security patch for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply this patch promptly to remediate the vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or temporary fixes are specified.