Hyperion Financial Management CVE-2026-87198

Exploitation requires the target to be Oracle Hyperion Financial Management 11.2.26.0.000 with the affected Security component reachable over HTTP from the attacker's network position; the CVSS vector confirms PR:N and UI:N, so no credentials and no victim interaction are needed, but AC:H specifies an additional condition the attacker must satisfy or discover before the bypass succeeds, and Oracle's advisory does not disclose what that condition is. Limiting factors are therefore: only this single version is listed as affected, the attack-complexity-high rating implies non-default state, timing dependence, or a narrow request pattern, and no public exploit code or KEV confirmation exists, meaning a would-be attacker currently has no off-the-shelf path. Defenders who cannot patch should treat any HFM instance reachable from untrusted networks as the practical precondition for risk, and note that authentication requirements for the post-bypass data operations are effectively removed once the flaw is triggered.

The headline 7.4 score is driven by full confidentiality and integrity impact over the network with no authentication or user interaction, but AC:H materially discounts exploitability: an attacker must satisfy an unspecified precondition before the bypass works, which typically narrows this from mass-scanning fodder to targeted, well-researched intrusion activity. No EPSS probability, no CISA KEV entry, and no public POC were present in the supplied data, so the current signal set is 'high impact, unproven exploitation' rather than an emergency; that said, a working authentication bypass against a consolidated financial reporting system is a high-value target for espionage and financial fraud, and even a mid-sized municipal IT team in walbrzych should treat this as urgent once a patch or reliable exploit detail emerges. Note the data gap explicitly: the absence of a CWE, of EPSS data, and of any vendor elaboration on the AC:H precondition means the real-world difficulty of exploitation cannot be independently verified, and the 7.4 score should be treated as a vendor-supplied upper bound until Oracle's advisory detail or observed exploitation clarifies the actual attack requirements.

An attacker who can reach the HFM web tier over HTTP probes the Security component and, after meeting the condition that makes the bypass viable, submits a request that is treated as authorized without valid credentials. With that access, the intruder reads consolidation data and, more damagingly, creates, deletes, or modifies records that feed financial reporting. The high attack complexity means the operator likely needs reconnaissance and possibly repeated attempts, and no public exploit code was identified at time of analysis, so this is currently a targeted-actor scenario rather than commodity scanning.