Oracle Hyperion Financial Management CVE-2026-87209

Exploitation requires a valid low-privileged account on Oracle Hyperion Financial Management 11.2.26.0.000 (CVSS PR:L) plus network reachability to the product's HTTP interface (AV:N), with no user interaction needed (UI:N) and low attack complexity (AC:L). The target must be the Security component of that specific supported release; the provided CVE text states no additional configuration prerequisite such as a specific enabled feature, so the determining factor is whether the HFM HTTP front end is exposed beyond a trusted network and whether low-privileged or guest-style accounts are provisioned. Limiting factors: authentication is required, so unauthenticated internet mass-scanning will not trigger it; the impact is read-only (no integrity loss), so data cannot be altered via this flaw; and only a partial, not full, denial of service is achievable.

CVSS 3.1 base 7.1 with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L describes a flaw that is easy to trigger remotely but requires a valid low-privileged application account - it is not unauthenticated. The confidentiality impact is the dominant harm (high), while integrity is unaffected and availability impact is only partial, meaning this is a data-exposure/access-control issue rather than a data-tampering or full-outage event. No EPSS probability, no KEV listing, and no POC status were included in the provided intelligence, so this cannot be characterized as actively exploited or as having publicly available exploit code; exploitation status should be treated as unconfirmed. Under SSVC-style logic the automatable criterion is plausible (AC:L, HTTP delivery) but exploitation requires harvesting credentials first, which raises the practical bar. The tag 'Authentication Bypass' conflicts with the PR:L metric in the supplied vector - either the flaw permits bypassing a specific authorization check with a low-privileged session, or the tag is imprecise; this should be verified against the Oracle advisory before prioritizing. Net assessment: a legitimate patch-cycle priority for organizations running exposed Hyperion HFM 11.2.26.0.000, but not an emergency unless exploitation status changes or internet-facing exposure is confirmed.

An attacker who already holds a low-privileged Hyperion Financial Management account - for example a contractor or a compromised reporting user - sends crafted HTTP requests to the HFM web interface targeting the Security component. Because the exploit requires no user interaction and no special complexity, the attacker can read critical consolidation and financial data beyond their authorization and simultaneously degrade service enough to cause a partial denial of service for legitimate users.