Hyperion Financial Management CVE-2026-87173

No special conditions - remote unauthenticated exploitation over TCP against Oracle Hyperion Financial Management 11.2.26.0.000 (component: Security), per AV:N/AC:L/PR:N/UI:N. The only prerequisites are network TCP reachability of the HFM Security/authentication interface and that the target runs the affected version. Limiting factors: HFM is an internal enterprise EPM application typically deployed behind the corporate perimeter rather than internet-facing, which materially reduces the realistic attacker population; exploitation also requires the affected 11.2.26.0.000 build. There is no user-interaction, privilege, or non-default-configuration requirement to gate the flaw itself.

This is a genuinely high-priority vulnerability by base-metric signals, though not yet confirmed under active exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction - consistent with CWE-287 (Improper Authentication), i.e. an authentication bypass in the Hyperion Security component. The 9.1 rather than 9.8 reflects A:N (no availability/DoS impact); confidentiality and integrity are both High (full read and create/delete/modify of all HFM-accessible data). CISA SSVC reinforces the technical severity: Automatable=yes and Technical Impact=total. However, SSVC Exploitation=none, and there is NO CISA KEV listing, NO public POC, and NO EPSS score in the provided data - so despite the near-critical score, there is no evidence of exploitation in the wild. This is a real patch-now priority given pre-auth + automatable + total impact on a financial-reporting system, but it should be framed as high latent risk rather than confirmed active threat. Note one signal to verify: Oracle's advisory provides zero technical detail (the CPU is a blanket page), so the exact bypass mechanism and network exposure of the affected interface cannot be confirmed from available data.

An unauthenticated attacker with TCP network access to the Oracle Hyperion Financial Management server sends crafted traffic to the exposed Security/authentication interface, bypassing authentication (CWE-287). Having gained access without credentials, the attacker reads all HFM-accessible financial data and creates, modifies, or deletes critical consolidation records. No public exploit code is identified at time of analysis, but the low attack complexity and unauthenticated network vector make weaponization straightforward if internals become known.