CVE-2026-87222

Oracle Hyperion Financial Management version 11.2.26.0.000 contains an easily exploitable flaw in its Security component that allows an unauthenticated attacker with network access via HTTP to hang or repeatedly crash the application, causing a complete denial of service. The vulnerability is triggered remotely with no privileges or user interaction required, and successful attacks affect only availability — confidentiality and integrity are not impacted. Organizations running the affected on-premises enterprise performance management software, typically corporate finance and consolidation systems, are at risk of having financial close and reporting workflows taken offline. The issue is rated high severity with a CVSS 3.1 base score of 7.5. It is not listed in CISA's Known Exploited Vulnerabilities catalog, no public proof-of-concept is known, and there is no evidence of in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that remediates this issue as soon as Oracle releases it for Hyperion 11.2.26.0.000. In the interim, restrict HTTP access to Hyperion Financial Management endpoints at the network layer so only trusted finance users and subnets can reach the service. Monitor for unexplained hangs or repeated crashes of the service and check logs for unauthenticated requests from unexpected sources.