CVE-2026-87220

CVE-2026-87220 is a vulnerability in the Security component of Oracle Hyperion Financial Management (HFM), affecting supported version 11.2.26.0.000. An unauthenticated attacker who can reach the physical communication segment (i.e., the network segment/VLAN) attached to the server running HFM can exploit it with low complexity and no user interaction, without needing valid credentials. A successful attack can hang or repeatedly crash the application, causing a complete denial of service, and can also allow unauthorized update, insert, or delete access to some HFM-accessible data; confidentiality is not impacted. Only on-premises deployments of Hyperion Financial Management 11.2.26.0.000 are affected, and the adjacent-network attack vector means exposure is limited to attackers already on the internal network segment hosting the HFM servers. No public proof-of-concept exists and the flaw is not on the CISA KEV list, so exploitation in the wild is not known.

What to do: Apply Oracle's Critical Patch Update that addresses CVE-2026-87220 and move off affected version 11.2.26.0.000 as soon as the patched release is available. Until patched, restrict which hosts can reach HFM services by placing the servers in a dedicated, tightly filtered network segment (VLAN/firewall rules limiting access to known admin and client sources), since exploitation requires only adjacency on that segment. Monitor HFM application and service logs for unexplained hangs, repeated crashes, or unexpected data modifications, and check whether any internal hosts on the HFM segment show anomalous activity.