Description
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-09-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch immediately
AI Analysis

Impact

The vulnerability is an unchecked resource‑usage flaw in the Security component of Oracle Hyperion Financial Management that lets an unauthenticated attacker with network access over TCP cause the application to hang or crash repeatedly. As a result, the service becomes unavailable, compromising the availability of financial reporting processes without affecting data confidentiality or integrity.

Affected Systems

Oracle Hyperion Financial Management version 11.2.26.0.000 is affected. No other versions are listed as vulnerable.

Risk and Exploitability

The CVSS 3.1 base score of 7.5 signifies a high availability impact. The EPSS score of less than 1 % suggests the probability of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the target over the network using TCP without any authentication, making the flaw potentially exploitable in open or poorly secured environments. Consequently, the issue should be treated as a high‑priority availability risk and fixed as soon as possible.

Generated by OpenCVE AI on September 18, 2026 at 14:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle’s security patch or upgrade to a version that includes the fix for Hyperion Financial Management 11.2.26.0.000.
  • Configure firewalls to block inbound TCP ports used by Hyperion Financial Management, allowing only trusted internal addresses to reach the service.
  • Set up monitoring to detect repeated hang or crash events and automatically restart the application when an outage occurs.

Generated by OpenCVE AI on September 18, 2026 at 14:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Denial of Service Vulnerability in Oracle Hyperion Financial Management

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Denial of Service Vulnerability in Oracle Hyperion Financial Management

Wed, 16 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle hyperion Financial Management
CPEs cpe:2.3:a:oracle:hyperion_financial_management:11.2.26.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Financial Management
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Hyperion Financial Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-15T23:14:52.225Z

Reserved: 2026-09-08T21:49:12.404Z

Link: CVE-2026-87215

cve-icon Vulnrichment

Updated: 2026-09-15T23:12:33.422Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:19:09.767

Modified: 2026-09-21T12:45:08.590

Link: CVE-2026-87215

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T14:15:09Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption