Hyperion Financial Management CVE-2026-87214

Requires an attacker already holding high application privileges on Oracle Hyperion Financial Management 11.2.26.0.000 (PR:H), with network reachability to the HFM HTTP interface. No user interaction and low complexity once that privilege is held. The primary limiting factor is the high-privilege prerequisite - this is exploitable by malicious insiders or attackers who have already compromised a privileged HFM account, not by anonymous remote attackers. The scope change (S:C) means a successful attack can affect additional products beyond HFM itself, so blast radius depends on how HFM is integrated with other Oracle EPM/Fusion components.

CVSS 3.1 base score is 9.1 (Critical), driven by network vector (AV:N), low attack complexity (AC:L), no user interaction (UI:N), a scope change (S:C), and full C:H/I:H/A:H impact. The critical tempering factor is PR:H - successful exploitation requires the attacker to already hold high privileges on Oracle Hyperion Financial Management, which sharply narrows the realistic threat population to insiders or attackers who have already compromised a privileged account. This is a genuine high-severity issue for a compromised-credential or malicious-insider threat model, not a pre-auth internet-worm scenario; the 9.1 is inflated relative to real-world exploitability precisely because PR:H is a strong gate. Exploitation status: no public exploit identified at time of analysis - no CISA KEV listing, no POC, and no EPSS score is provided, so there is no signal of active or imminent exploitation. No SSVC decision framework data was supplied. Net priority: patch in the next scheduled cycle for exposed/multi-tenant HFM instances given the scope-change and full-takeover impact, but the PR:H requirement makes this lower urgency than the pre-auth HFM siblings (e.g. CVE-2026-87188/CVE-2026-87184 at 9.8) in the same Oracle September 2026 CPU.

An attacker who already holds a high-privileged Hyperion Financial Management account (or has hijacked such an account) sends crafted HTTP requests to the HFM Security component over the network. Low complexity and no user interaction mean the request reliably compromises the application, and the scope change lets the impact spill beyond HFM into additional connected products, culminating in full takeover. No public exploit code is known, so this would require attacker-developed tooling.