Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVE-2026-87220)
A vulnerability exists in Oracle Hyperion Financial Management version 11.2.26.0.000 that allows an unauthenticated attacker with access to the physical communication segment to cause denial of service and unauthorized modification of accessible data. The vulnerability can lead to repeated crashes or hangs and unauthorized insert, update, or delete operations on data. The CVSS 3.1 base score is 7.1, indicating high severity with impacts on integrity and availability.
AI Analysis
Technical Summary
CVE-2026-87220 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker who has access to the physical communication segment attached to the hardware running the product to compromise the system. Successful exploitation can cause repeated crashes or hangs (denial of service) and unauthorized data modification (insert, update, delete) within the accessible data of Oracle Hyperion Financial Management. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, with a base score of 7.1.
Potential Impact
The vulnerability impacts the integrity and availability of Oracle Hyperion Financial Management by enabling unauthorized data modification and causing denial of service through system hangs or crashes. Confidentiality is not impacted. The attacker must have access to the physical communication segment, which limits remote exploitation. No known exploits in the wild have been reported.
Mitigation Recommendations
Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. No indication of temporary or alternative mitigations is provided; patching is the recommended remediation. The affected version is 11.2.26.0.000, and upgrading to a patched version is necessary.
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVE-2026-87220)
Description
A vulnerability exists in Oracle Hyperion Financial Management version 11.2.26.0.000 that allows an unauthenticated attacker with access to the physical communication segment to cause denial of service and unauthorized modification of accessible data. The vulnerability can lead to repeated crashes or hangs and unauthorized insert, update, or delete operations on data. The CVSS 3.1 base score is 7.1, indicating high severity with impacts on integrity and availability.
CVSS v3.1
Score 7.1high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-87220 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker who has access to the physical communication segment attached to the hardware running the product to compromise the system. Successful exploitation can cause repeated crashes or hangs (denial of service) and unauthorized data modification (insert, update, delete) within the accessible data of Oracle Hyperion Financial Management. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, with a base score of 7.1.
Potential Impact
The vulnerability impacts the integrity and availability of Oracle Hyperion Financial Management by enabling unauthorized data modification and causing denial of service through system hangs or crashes. Confidentiality is not impacted. The attacker must have access to the physical communication segment, which limits remote exploitation. No known exploits in the wild have been reported.
Mitigation Recommendations
Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. No indication of temporary or alternative mitigations is provided; patching is the recommended remediation. The affected version is 11.2.26.0.000, and upgrading to a patched version is necessary.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-737q-3rqf-8q2w
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-87220"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaa07d955bf5e2cf5ea2d63
Added to database: 09/16/2026, 03:07:05 UTC
Last enriched: 09/16/2026, 03:29:12 UTC
Last updated: 09/16/2026, 06:01:22 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.