Description
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-09-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A flaw in the Security component of Oracle Hyperion Financial Management enables an unauthenticated attacker with network access through HTTP to trigger a controlled hang or crash, resulting in a full denial of service. The vulnerability relies on an uncontrolled resource consumption condition, identified as CWE-400, and can be exercised with minimal effort once connectivity to the affected service is available.

Affected Systems

Oracle Hyperion Financial Management 11.2.26.0.000 is affected. Only this product version is listed as vulnerable.

Risk and Exploitability

The CVSS v3.1 base score of 7.5 indicates a significant impact on availability. The EPSS score of less than 1% shows a very low, but non‑zero, probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only unauthenticated HTTP access, making the attack vector simple and widely available over a network.

Generated by OpenCVE AI on September 18, 2026 at 14:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor provided patch or upgrade to a version that contains the fix for Hyperion 11.2.26.0.000.
  • Configure network firewalls or VPNs to restrict direct HTTP access to the Hyperion service to trusted administrators only.
  • Implement monitoring of application logs and network traffic to detect repeated crash requests or abnormal resource usage and be prepared to roll back or mitigate disruptions.

Generated by OpenCVE AI on September 18, 2026 at 14:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP-Induced Denial of Service via Resource Exhaustion in Oracle Hyperion Financial Management

Wed, 16 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP-Induced Denial of Service via Resource Exhaustion in Oracle Hyperion Financial Management

Wed, 16 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle hyperion Financial Management
CPEs cpe:2.3:a:oracle:hyperion_financial_management:11.2.26.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Financial Management
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Hyperion Financial Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-15T23:14:52.074Z

Reserved: 2026-09-08T21:49:12.404Z

Link: CVE-2026-87222

cve-icon Vulnrichment

Updated: 2026-09-15T23:12:30.137Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:19:10.523

Modified: 2026-09-22T17:17:33.960

Link: CVE-2026-87222

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T14:15:09Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption