Hyperion Financial Management CVE-2026-87189

Exploitation requires the attacker to already hold HIGH privileges (PR:H) on the target - an administrative or operator-level account on Oracle Hyperion Financial Management or its underlying Oracle stack - and network reachability to the target over Oracle Net (the Oracle database networking protocol/listener), not standard HTTP. No user interaction is needed (UI:N) and complexity is low (AC:L) once privileged access and Oracle Net connectivity exist. Only version 11.2.26.0.000 is listed as affected. Limiting factors: the PR:H requirement excludes anonymous internet attackers, so realistic exploitation depends on insider access, credential theft, or prior compromise; exposure is further limited to environments where the Oracle Net listener is reachable by the attacker rather than being firewalled to trusted hosts. The scope change (S:C) means a successful compromise can affect additional products beyond HFM.

This is a genuinely high-severity but access-gated vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, score 9.1) describes a network-reachable, low-complexity flaw that yields full compromise (Confidentiality, Integrity, Availability all High) plus a scope change into additional products. The single largest limiter is PR:H - the attacker must already hold high (administrative/operator-level) privileges on the target, which sharply narrows the realistic threat population to insiders, compromised admin accounts, or lateral-movement follow-on. The 9.1 rating is well-calibrated: PR:H drags the score down from the pre-auth 9.8 Hyperion siblings, but the S:C scope change plus full-triad impact push it back up. Prioritization signals beyond CVSS are absent: no EPSS probability is provided, the CVE is NOT on CISA KEV, and no public POC is identified - so there is no evidence of active or imminent widespread exploitation. Net: treat as a high-priority PATCH item for organizations running Hyperion because the impact is total and the scope crosses product boundaries, but the PR:H gate means this is not a mass-exploitation, internet-scannable emergency in the way a PR:N Hyperion flaw would be. Note the description says the attacker reaches the target 'via Oracle Net' (the Oracle database networking layer), not HTTP, which further constrains exposure to environments where the Oracle Net listener is reachable by the attacker.

An attacker who already holds high-privilege access - for example a compromised Hyperion/database administrator account or an insider - connects to the Oracle Hyperion Financial Management Security component over Oracle Net and abuses the flaw to fully take over the application. Because of the scope change, the attacker can then pivot to impact additional connected products beyond HFM itself. No public exploit code is identified at time of analysis, and exploitation requires pre-existing high privileges.