Oracle Hyperion Financial Management CVE-2026-87222

Exploitation requires that the Oracle Hyperion Financial Management Security component's HTTP endpoint be reachable from the attacker's network position - the CVSS vector AV:N/PR:N/UI:N means no credentials, no session, and no user interaction are needed, so any HTTP client with a route to the HFM web tier qualifies. The limiting factors are exposure and version: only the supported release 11.2.26.0.000 is named as affected, so installations on other builds may not be vulnerable, and deployments where HFM is confined behind a VPN, reverse proxy requiring authentication, or an internal-only firewall ACL are not reachable by unauthenticated external attackers. Availability-only impact (C:N/I:N/A:H) means the attacker cannot read or alter financial data through this vector; the practical constraint on impact duration is whether the target restarts the crashed process automatically or requires manual intervention.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) describes the worst realistic case: no credentials, no user interaction, low complexity, network-reachable over HTTP, with complete loss of availability of the HFM service. That is a genuinely dangerous profile for an internet- or intranet-exposed web application, because a single attacker can repeatedly crash the process at will. Against that, the intelligence picture is thin: there is no CISA KEV entry, no EPSS score supplied, and no public exploit code identified, so there is no signal of active or widespread exploitation. The practical priority therefore depends almost entirely on exposure - an internet-facing HFM instance should be treated as urgent, and even a mid-sized municipal IT team in kalisz running an unreachable-internet HFM behind VPN should still patch on the normal Oracle CPU/CSPU cadence because a single authenticated-adjacent insider or compromised workstation on the same segment can trigger the crash. Note the conflict to verify: the description calls the attacker 'unauthenticated' and CVSS agrees (PR:N), but Oracle CPU advisories sometimes scope exploitation to specific deployment tiers, so confirm whether the affected HTTP endpoint is reachable without a session on your installation.

An attacker who can reach the HFM web interface sends a stream of malformed or resource-intensive requests to the Security component's HTTP endpoint, causing the application process to hang or crash; no credentials or user interaction are required per the CVSS vector. Because the crash is described as 'frequently repeatable', the attacker can script the request in a loop to keep the service down, blocking finance users from consolidation, reporting and period-close activity for as long as the traffic continues. No public exploit code has been identified at time of analysis, so this currently requires a targeted attacker rather than commodity scanning.