CVE-2026-87215 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker with network access via TCP to cause a hang or frequent crash, resulting in a complete denial of service (DoS). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact. This vulnerability is addressed by Oracle's September 2026 Critical Security Patch Update, which includes targeted fixes for this and other vulnerabilities.

Successful exploitation results in denial of service by causing the Oracle Hyperion Financial Management application to hang or crash repeatedly. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely without authentication, making it a significant availability risk for affected systems.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the security patches provided in this update promptly. Remaining on actively supported versions and timely application of Oracle patches is recommended to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are specified in the advisory.