Oracle Hyperion Financial Management CVE-2026-87191

Exploitation requires a valid low-privileged account on Oracle Hyperion Financial Management 11.2.26.0.000 (CVSS PR:L) plus network reachability to the application's HTTP interface (AV:N) - no user interaction (UI:N) and no elevated role, race condition, or non-default setting is stated in the source data. The vulnerable surface is specifically the Security component, so the attacker must be able to reach the authentication/authorization-handling endpoints of the application rather than a back-office batch interface. Limiting factors: an unauthenticated internet attacker cannot exploit this without first obtaining credentials, and deployments where the Hyperion HTTP listener is firewalled to an internal finance subnet or fronted by an authenticating proxy reduce the exposed attacker pool further. The supplied 'Authentication Bypass' tag, if accurate, could indicate that the intended authorization check is defeated after a legitimate login rather than that login itself is avoidable; this has not been confirmed against the Oracle advisory and should be verified.

Signals are mixed but coherent. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates exploitation is easy once credentials exist - no user interaction, low complexity, network reachable - but PR:L means the attacker must already be an authenticated, low-privileged user of the application, which materially narrows the population of potential attackers versus an unauthenticated flaw. Confidentiality impact is High while Integrity is None and Availability is Low, so the realistic worst case is bulk disclosure of consolidation/financial data plus a partial service degradation, not data tampering or full outage. No EPSS score, no CISA KEV listing, and no public proof-of-concept were supplied, which argues against treating this as an imminent mass-exploitation event; the absence of KEV data is a data gap, not proof that exploitation has not occurred, and the missing EPSS value should be re-checked before final prioritization. Given AV:N, AC:L, no UI and no special configuration stated, the flaw is automatable in principle once an account is obtained, so insider risk and compromised low-privilege service accounts are the dominant threat model. The supplied tag 'Authentication Bypass' is not fully corroborated by the CVSS PR:L metric, which implies authentication is still required - treat the bypass characterization as unverified vendor-adjacent labeling and confirm the exact authorization boundary with Oracle's advisory.

An attacker who already possesses a valid low-privileged Hyperion Financial Management account - an insider, a compromised contractor credential, or a hijacked service account - sends crafted HTTP requests to the Security component to bypass intended authorization checks. AC:L and UI:N mean no special timing, race condition, or victim interaction is needed, so the attacker can script repeated requests to harvest critical consolidation and financial data and to induce a partial denial of service against the application. No public exploit code was identified at time of analysis, so the attacker would need to develop the request pattern independently from the patch delta or by probing the endpoint.