CVE-2026-87213 is a security vulnerability affecting Oracle Hyperion Financial Management version 11.2.26.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 score of 7.4 with high confidentiality and integrity impacts and requires high attack complexity. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple Oracle products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management. This results in a high impact on confidentiality and integrity of the data accessible through the product. There is no impact on availability reported. The vulnerability requires network access via HTTP and has a high attack complexity, but no privileges or user interaction are needed for exploitation.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the relevant patches for Oracle Hyperion Financial Management version 11.2.26.0.000 as soon as possible. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are indicated in the advisory.