CVE-2026-87223

Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable flaw in its Security component that lets an unauthenticated attacker with network access via HTTP compromise the application. Successful attacks allow the attacker to create, delete, or modify critical data — or all data accessible to Hyperion Financial Management — and to cause a hang or repeatable crash, resulting in complete denial of service. The vulnerability carries a CVSS 3.1 base score of 9.1 (critical), with high integrity and availability impact but no confidentiality impact, meaning attackers can corrupt or destroy financial data rather than read it. Organizations running the affected on-premises release of this enterprise financial consolidation product are exposed, particularly any instance reachable over a network. No public proof-of-concept exists and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation is not currently observed.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87223 to version 11.2.26.0.000 environments as soon as it is available. Restrict HTTP access to Hyperion Financial Management endpoints to trusted internal networks or VPN, and place a reverse proxy or WAF requiring authentication in front of any internet-reachable instance. Review audit logs for unexplained data creation, deletion, or modification and for repeated application crashes or hangs on financial consolidation data.