CVE-2026-87222 is a security vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker with network access via HTTP to cause a hang or repeated crash, resulting in a complete denial of service (DoS). The CVSS 3.1 base score is 7.5, reflecting a high severity with an impact on availability only (no confidentiality or integrity impact). Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple Oracle products, including Oracle Hyperion Financial Management.

Successful exploitation results in a denial of service condition by causing the Oracle Hyperion Financial Management application to hang or crash repeatedly. There is no impact on confidentiality or integrity, but availability is severely affected. The vulnerability is exploitable remotely without authentication over HTTP.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are specified beyond applying the official patch.