Oracle Hyperion Financial Management CVE-2026-87220

Required: the attacker must be on the adjacent network segment ('access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes' per the vendor description), meaning Layer-2/Layer-3 reachability to the HFM service rather than internet-wide reachability; the vulnerability is in the Security component of Hyperion Financial Management 11.2.26.0.000. No authentication (PR:N), no user interaction (UI:N) and no special race or complexity (AC:L) is required, so once adjacency exists the attack is direct against default service behavior. Limiting factors: the attacker loses access the moment the network is properly segmented or the HFM listener is restricted by firewall ACLs; the confirmed impact is availability (complete DoS) with only a low-integrity effect, and no confidentiality loss; and no public exploit code has been identified, so exploitation currently requires bespoke research against the specific HFM build.

The CVSS vector is internally consistent and unusual in a useful way: AV:A with PR:N and AC:L means the barrier is network adjacency, not credentials or payload cleverness, so an attacker who already has a foothold on the same VLAN, subnet, or physical segment as the HFM host can fire the exploit with no authentication and no user interaction - even a mid-sized municipal IT team in mielec should treat internal segmentation as the deciding control here. Availability is the dominant impact (A:H, complete DoS) with only partial integrity loss (I:L) and no confidentiality impact (C:N), which reframes this as an operational-resilience problem for finance close cycles rather than a data-breach headline. Signals are thin: there is no CISA KEV listing, no public exploit code identified, and no EPSS score or SSVC decision point provided in the input, so exploitation likelihood cannot be quantified; the realistic ranking therefore rests on the low exploitation complexity plus the value of HFM uptime during consolidation periods, not on evidence of active attacks. Note the vendor's own phrasing ties access to 'the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes' - defenders should verify whether that describes a genuine Layer-2 adjacency requirement (which would cap risk at insiders and compromised hosts) or a broader routable path before treating this as an internet-facing emergency.

An attacker with a foothold on any host in the same network segment as the HFM server - a compromised workstation, a rogue device, or a co-tenant VM - sends crafted requests to the HFM Security component and, because the vector is AC:L/PR:N/UI:N, does not need credentials or victim interaction. Successful attempts crash or hang the service repeatedly, halting consolidation and financial-close activity, while the same flaw permits limited unauthorized inserts, updates or deletes to data HFM can access. No public exploit code has been identified, so an attacker would currently need capability to develop the request themselves, which slightly narrows the realistic threat to motivated insiders or attackers already inside the perimeter.