CVE-2026-87218

Oracle Hyperion Financial Management version 11.2.26.0.000 contains an easily exploitable flaw in its Security component that requires no authentication or user interaction. An unauthenticated attacker positioned on the same physical communication segment (adjacent network) as the HFM server can send crafted traffic to compromise the application. Successful exploitation gives the attacker unauthorized ability to create, delete, or modify critical data (or all HFM-accessible data) and to cause a hang or frequently repeatable crash, resulting in complete denial of service; confidentiality is not impacted. Only organizations running the affected supported version 11.2.26.0.000 are exposed, and because exploitation requires network adjacency, internal segments hosting HFM are the primary concern. No public proof of concept exists, the flaw is not in the CISA KEV catalog, and no in-the-wild exploitation is known.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw and move off affected version 11.2.26.0.000 as soon as the fixed release is available. Until patched, use firewall rules and VLAN segmentation to restrict which hosts and subnets can reach HFM server ports, since exploitation requires adjacency to the server's network segment. Review HFM audit logs for unexplained data modifications and investigate any new patterns of service hangs or repeated crashes.