CVE-2026-87215

CVE-2026-87215 is an easily exploitable flaw in the Security component of Oracle Hyperion Financial Management, affecting supported version 11.2.26.0.000. An unauthenticated attacker with network access via TCP can send crafted requests to trigger the flaw and cause the application to hang or crash repeatedly, resulting in a complete denial of service. The vulnerability affects only availability — there is no impact on confidentiality or integrity — and carries a CVSS 3.1 base score of 7.5. Organizations running the affected release of this on-premises enterprise financial close and consolidation platform are exposed, particularly if the service is reachable from untrusted network segments. It is not listed in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept is known, so there is no evidence of active exploitation to date.

What to do: Apply the Oracle Critical Patch Update that remediates this issue for Hyperion Financial Management 11.2.26.0.000 as soon as it is available. Until patched, restrict TCP access to Hyperion Financial Management services to trusted internal subnets and VPN clients, and monitor for repeated crashes or hangs of the service as a sign of attempted abuse. Verify no HFM ports are unintentionally exposed to the internet via perimeter firewall rules or public scan data.