Is CVE-2026-87145 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87145 being exploited in the wild.

How severe is CVE-2026-87145?

High severity, with a CVSS score of 7.3, published 15 September 2026.

Which products and versions are affected?

Oracle Hyperion Data Relationship Management 11.2.26.0.000.

Is there a fix for CVE-2026-87145?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-87145 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-87145?

Check whether you run Oracle Hyperion Data Relationship Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87145: Oracle Hyperion Data Relationship Management authentication bypass

CVE-2026-87145 · Severity: high · CVSS 7.3 · Published 2026-09-15

Oracle Hyperion Data Relationship Management is an enterprise tool used to model and manage complex data relationships across financial systems. An unauthenticated network attacker can bypass access controls to read, modify, or delete sensitive data, and can also cause service disruptions. This could enable unauthorized access to financial data, data manipulation, and operational outages.

Technologies: Oracle Hyperion Data Relationship Management. Vendors: Oracle.

Quick answers

Is CVE-2026-87145 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87145 being exploited in the wild.
How severe is CVE-2026-87145?: High severity, with a CVSS score of 7.3, published 15 September 2026.
Which products and versions are affected?: Oracle Hyperion Data Relationship Management 11.2.26.0.000.
Is there a fix for CVE-2026-87145?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87145 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-87145?: Check whether you run Oracle Hyperion Data Relationship Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an authentication bypass or access control vulnerability in Oracle Hyperion Data Relationship Management's HTTP interface. The vulnerability requires no user interaction and is easily exploitable via the network; no authentication credentials are needed to trigger it. An attacker can read a subset of application data (confidentiality impact), update, insert, or delete data (integrity impact), and trigger a partial denial of service condition (availability impact). The vulnerability affects version 11.2.26.0.000. Patch availability from Oracle is expected per their standard security update cycle.

Affected products

Oracle Hyperion Data Relationship Management 11.2.26.0.000

Timeline

2026-09-15: disclosed

References

https://www.oracle.com/security-alerts/cspusep2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.