CVE-2026-87197 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical data and the ability to update, insert, or delete some accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects a network attack vector with low attack complexity, no privileges or user interaction required, and high confidentiality impact with limited integrity impact. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized access to critical data within Oracle Hyperion Financial Management and unauthorized modification (update, insert, delete) of some accessible data. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. No known exploits in the wild have been reported as of the publication date.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. It is strongly recommended that users of Oracle Hyperion Financial Management version 11.2.26.0.000 apply the provided patch without delay to mitigate this vulnerability. Oracle advises remaining on actively supported versions and promptly applying security patches to prevent exploitation.