CVE-2026-87222 in Hyperion Financial Management
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Security component of Oracle Hyperion Financial Management, specifically affecting version 11.2.26.0.000 and potentially other supported releases in that lineage. This flaw represents a critical weakness in the application's handling of incoming network requests, allowing for remote exploitation by unauthenticated actors. The vulnerability is classified under CWE-400, which denotes Uncontrolled Resource Consumption, as it enables an attacker to trigger conditions that exhaust system resources or cause the application state to become unstable. From a threat intelligence perspective, this aligns with ATT&CK technique T1499, Endpoint Denial of Service, where adversaries aim to disrupt availability rather than compromise confidentiality or integrity. The attack vector is network-based via HTTP, requiring no prior authentication and involving minimal complexity, which significantly lowers the barrier for entry for malicious actors seeking to impact operational continuity.
The technical nature of this flaw allows an unauthenticated attacker with network access to send specially crafted requests that result in a hang or frequent, repeatable crashes of the Oracle Hyperion Financial Management service. This behavior indicates a failure in input validation or resource management logic within the HTTP processing layer. When triggered, the application fails to recover gracefully from the malformed or excessive inputs, leading to a complete denial of service condition. The impact is strictly on availability, as confirmed by the CVSS 3.1 base score of 7.5 and the vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). This means that while there are no direct consequences to data confidentiality or integrity in this specific instance, the operational impact is severe due to the complete unavailability of the financial management platform during an attack.
The operational implications for organizations relying on Oracle Hyperion Financial Management are substantial. As a critical tool for enterprise performance management and financial reporting, any downtime directly impacts business processes such as budgeting, forecasting, and consolidation. A successful exploitation can lead to significant productivity losses, missed regulatory filing deadlines, and potential reputational damage if the outage is prolonged or frequent. Since the vulnerability requires no user interaction and no authentication, it poses a persistent threat that could be exploited by automated scanning tools or opportunistic attackers on any network segment with access to the affected server's HTTP ports.
Mitigation strategies must focus on immediate remediation through vendor-provided patches as soon as they become available from Oracle Support. In the interim, organizations should implement strict firewall rules and web application firewalls to restrict access to the Hyperion Financial Management interface only to authorized IP addresses or subnets. Additionally, enabling rate limiting on HTTP endpoints can help mitigate the impact of resource exhaustion attacks by throttling excessive requests that may trigger the vulnerability. Regular monitoring for unusual spikes in error logs related to crashes or hangs is also recommended to detect potential exploitation attempts early. Ensuring that all security components are updated and configured according to Oracle's hardening guidelines will further reduce the attack surface associated with this flaw.