Hyperion Financial Management CVE-2026-87213

Exploitation requires network access to the Oracle Hyperion Financial Management 11.2.26.0.000 HTTP interface and no credentials (CVSS PR:N with AV:N via HTTP, per Oracle's description), so the realistic requirement is that the HFM web tier is reachable by the attacker - typically an internet-facing deployment or an attacker already positioned on the corporate network. The limiting factor is attack complexity: Oracle rates it AC:H and describes the vulnerability as 'difficult to exploit,' indicating a specific request sequence, internal state, or timing window must be satisfied rather than a single simple request, which sharply reduces the pool of attackers able to weaponize it. No user interaction is required (UI:N) and no special product feature beyond the Security component itself is named by Oracle; because the vendor withheld the technical root cause, the exact configuration, endpoint, or protocol preconditions cannot be enumerated from available data.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, base 7.4) describes a network-reachable, unauthenticated flaw with high confidentiality and integrity impact but no availability impact, and the high attack complexity is the main mitigating signal. That combination is unusual: unauthenticated but difficult to exploit suggests either a race condition, a precisely ordered request flow, or a dependent internal state, meaning opportunistic mass scanning is unlikely to succeed while a motivated, knowledgeable attacker with target visibility could still manage it. No EPSS score, no CISA KEV entry, and no public exploit or PoC were provided, so the exploitation status per available data is 'no public exploit identified at time of analysis.' Real-world priority should be driven by data sensitivity - HFM holds consolidated financial records, so integrity loss is a financial-reporting and compliance risk - but the AC:H and missing weaponization signals argue against treating this as an emergency out-of-band incident response. Key data is missing (no CWE, no EPSS, no KEV, no patch version in the supplied references), and those gaps should be closed before final risk sign-off.

An attacker with network reachability to the HFM web interface sends a crafted HTTP request sequence aimed at the Security component, exploiting a narrow condition to bypass authentication and obtain an authenticated-equivalent session without credentials. Once inside, the attacker reads and modifies or deletes financial consolidation data, corrupting reporting integrity without triggering any availability failure that would draw immediate attention. The high attack complexity means the attacker likely needs prior reconnaissance of the target's request flow and possibly repeated attempts to win the timing or state condition.