Hyperion Financial Management CVE-2026-87212

Exploitation requires the attacker to have network reachability to the HFM service path that accepts the SQL-mediated request, and the target must be the specific supported build 11.2.26.0.000 with the Security component in its default, unmodified state - no credentials and no user interaction are required per AV:N/AC:H/PR:N/UI:N. The limiting factor is AC:H: the successful request depends on backend state, timing, or an exact query/parameter construction that ordinary fuzzing will not reliably reproduce, so this is not a spray-and-pray vulnerability. Any intermediate control that prevents untrusted sources from reaching the HFM/WebLogic endpoint - network segmentation, reverse-proxy allow-listing, or removal of external publishing - blocks the attack entirely. Deployments running unsupported or earlier 11.2.x builds are outside the advisory's stated affected set, and platform-specific behaviour (WebLogic version, database back-end and its patch level) may further restrict exploitability; those variables are not detailed in the supplied data and should be confirmed with Oracle.

The signal set is thin but internally consistent: CVSS 3.1 scores 7.4 with AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, meaning no credentials and no user interaction are needed, but the attacker must land a high-complexity exploit against a reachable service - a real constraint that separates this from a script-kiddie mass-scan target, even though a mid-sized municipal IT team in inowroclaw running HFM for budget consolidation should still treat it as urgent once the patch is verified in their environment. EPSS was not provided, KEV status is absent, and no POC is referenced, so there is no evidence of active exploitation and no evidence of a public exploit; the description itself calls the flaw 'difficult to exploit', which argues against opportunistic automation. The offsetting factor is impact: C:H/I:H with no availability loss means a successful hit yields read/write over the entire accessible financial data set, i.e. period-end close data, audit trails and reported results. The 'Authentication Bypass' tag is the only classification hint beyond the vendor text and should not be treated as confirmed. Whether this is a true priority depends on internet or broad-intranet exposure of the HFM/WebLogic endpoint and the SQL-facing component - where that exposure exists, patch urgency is high despite the high attack complexity; where HFM sits behind layered segmentation with no untrusted reachability, residual risk is materially lower.

An unauthenticated attacker who can reach the HFM web/SQL service crafts requests that target the security layer's query handling and, by satisfying a narrow timing or state condition, causes the application to return or accept data without a valid session. Once the bypass succeeds, the attacker reads the full accessible consolidation data set and can inject, alter, or delete financial records, undermining close-cycle integrity and audit evidence. The high attack complexity means repeated, carefully instrumented attempts are more likely than a single automated payload, and no public exploit code has been identified at time of analysis.