Hyperion Financial Management CVE-2026-87200

Exploitation requires network reachability to the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000, and per the CVSS vector none of authentication (PR:N), user interaction (UI:N), or elevated complexity (AC:L) is needed - this is unauthenticated, remote, low-complexity exploitation. The practical limiting factor is deployment topology rather than any technical precondition: HFM is typically deployed on internal enterprise networks behind segmentation rather than exposed to the internet, so an attacker must already have a foothold on an internal segment, VPN, or partner network path to the HFM web tier. The flaw is also version-specific to 11.2.26.0.000, so environments on other maintenance levels may not be affected, and the absence of any confidentiality impact means the endpoint in question is state-changing rather than data-reading.

The CVSS vector is the dominant signal here: AV:N/AC:L/PR:N/UI:N means a fully unauthenticated, low-complexity, no-interaction attack against a network service, and the I:H rating means write-level control over critical consolidation data - the worst outcome for a financial-consolidation system subject to audit and regulatory reporting. That said, the practical exposure depends on network placement: HFM is normally an internal enterprise application behind segmentation, not an internet-facing service, so the effective attack surface is often limited to internal or VPN-connected users. The provided data contains no EPSS score, no CISA KEV entry, and no evidence of publicly available exploit code, so despite the high base score there is no confirmed evidence of active exploitation - a mid-sized municipal IT team in ustka running HFM on an internal subnet faces a meaningfully different risk profile than an organization exposing the web tier to untrusted networks. Treat this as a high-priority patch for any internet- or partner-facing HFM deployment and a scheduled patch for fully segmented internal ones.

An attacker with network reachability to the HFM web tier sends crafted HTTP requests directly to the vulnerable security component, without authenticating or requiring any victim interaction. Because the flaw permits write-level access, the attacker can alter or delete consolidation records and metadata in the financial repository, then trigger a partial denial of service to mask or delay detection. There is no public exploit code in the provided data, so this scenario assumes an attacker with the skill to reverse-engineer the exposed endpoint, which the low AC:L rating suggests is not a high barrier.