Hyperion Financial Management CVE-2026-87195

Precondition is network reachability to the TLS listener of Oracle Hyperion Financial Management 11.2.26.0.000 running the 11.2.26.0.000 Security component; no authentication and no user interaction are required per the CVSS vector (PR:N/UI:N). What LIMITS exploitation is the AC:H rating: Oracle describes the flaw as "difficult to exploit," implying the bypass only succeeds under a narrow timing, request-sequence or server-state condition rather than through a simple single request. Deployments where the HFM service is not internet-exposed and is reachable only from a hardened internal segment reduce exposure accordingly. The exact triggering condition is not disclosed in the supplied data, and the "Authentication Bypass" characterization comes from tagging rather than vendor text - verify against Oracle's advisory before assuming a specific bypass technique.

The CVSS 3.1 vector yields 7.4 with AV:N/PR:N/UI:N, meaning no credentials and no user interaction are needed, but AC:H is a meaningful damping factor: successful exploitation is not a single trivial request and likely depends on a specific timing window or system state. There is no KEV listing, no reported POC, and no EPSS value in the supplied data, so while C:H/I:H makes the worst-case impact severe (full read and write of HFM consolidation data), the practical exploitation probability is unknown and should not be treated as imminent. SSVC framing: exploitation status = none observed; automatable = likely no, given AC:H; technical impact = partial-to-total (integrity and confidentiality, no availability loss). CAVEAT: the description asserts network/A:H exploitation unauthenticated, but provides no technical detail on the triggering condition, and the mechanism behind the "Authentication Bypass" tag is not corroborated by a CWE or advisory text - treat the exact exploit precondition as unverified and validate against Oracle's patch notes before prioritizing.

An attacker with network reachability to the HFM TLS endpoint sends crafted requests targeting the Security component, attempting to bypass authentication checks; because the flaw is rated high-complexity, the attacker likely needs repeated attempts or a specific server state/timing window before the request succeeds. Once the bypass lands, the attacker obtains read and write access to consolidation data - exfiltrating financial figures and inserting, altering or deleting records. No public exploit code was identified at time of analysis, so this scenario currently requires bespoke reverse engineering of the target service.