CVE-2026-87212 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker with network access via SQL to compromise the system, potentially resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The vulnerability has a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impacts and requires high attack complexity without privileges or user interaction. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple Oracle products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, as well as unauthorized access to all accessible data. This compromises confidentiality and integrity but does not affect availability. The vulnerability is difficult to exploit and requires network access via SQL without authentication.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers should apply the relevant patches for Oracle Hyperion Financial Management version 11.2.26.0.000 without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to prevent exploitation. No additional mitigation steps are specified beyond applying the official patch.