Hyperion Financial Management CVE-2026-87208

Exploitation requires a valid low-privileged account in Oracle Hyperion Financial Management 11.2.26.0.000 (CVSS PR:L), network reachability to the HFM HTTP interface on version 11.2.26.0.000 specifically, and use of the affected Security component; no user interaction is needed (UI:N) and no elevated role is required. The critical limiting factor is authentication: this is not unauthenticated exploitation, so an attacker must first obtain or already possess credentials, which raises the bar against purely external mass scanning. Further limits not confirmed in the data include whether the flaw requires a particular HFM module, consolidation application, or WebLogic configuration to be reachable, and whether any specific feature flag or non-default setting is involved - the vendor advisory would need to be consulted to confirm those deployment specifics.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) describes a genuinely reachable flaw: no user interaction, low attack complexity, and network exposure, but it explicitly requires a low-privileged account, which materially narrows the attacker population to users who already hold valid HFM credentials. In SSVC terms this is exploitation status 'none' (no KEV, no public exploit code identified), automatable 'yes', technical impact 'partial' given the high confidentiality but only low integrity impact, which lands in the 'act' to 'attend' band rather than emergency-patch territory. EPSS was not provided, so no quantitative exploitation probability could be cross-checked against the KEV signal; that absence should be stated explicitly rather than assumed low, and the practical consequence is that even a mid-sized municipal IT team in kalisz should treat this as urgent once a patch cycle is available, because financial consolidation data is exactly the kind of high-value, regulatorily sensitive content that drives follow-on fraud and disclosure risk.

An attacker who already holds a low-privileged HFM account - for example a contractor, a former employee whose account was not deprovisioned, or a compromised help-desk credential - authenticates normally and sends crafted HTTP requests to a Security-component endpoint that fails to enforce role-based authorization. Because complexity is low and no user interaction is required, the attacker can script the requests to bulk-harvest financial consolidation data and make limited unauthorized updates or deletions. No public exploit code has been identified, so the attack currently requires the actor to develop or hand-roll the request sequence rather than downloading a ready-made tool.