Hyperion Financial Management CVE-2026-87215

Exploitation requires only network reachability (TCP) to the Oracle Hyperion Financial Management 11.2.26.0.000 Security component service - no credentials, no user interaction and no non-default configuration are needed per the CVSS vector AV:N/AC:L/PR:N/UI:N. What limits real-world exploitation is exposure and reachability, not application settings: HFM is normally deployed on an internal enterprise network behind firewalls, so an attacker generally needs a foothold on a trusted segment, a misconfigured internet-facing EPM/WebLogic front end, or a VPN/partner path into the HFM subnet. Impact is bounded to availability - the attacker cannot read or modify financial data (C:N/I:N) - and success depends on the target service being live and reachable at the time of the attempt, since the outcome is a hang or crash rather than persistent compromise.

The CVSS 3.1 vector is maximal on the availability axis: AV:N with AC:L, PR:N and UI:N means an unauthenticated attacker with network reachability can trigger the condition without credentials, user interaction or special preconditions, and A:H reflects a hang or repeatedly reproducible full outage. However, the impact is confined to availability - C:N/I:N - so the flaw cannot be leveraged for data theft or tampering, which materially lowers its strategic value for ransomware or espionage. No CISA KEV entry, no EPSS score and no POC listing were supplied, so exploitation status is 'no public exploit identified at time of analysis'; a 7.5 availability-only score with no exploitation telemetry places this in a patch-on-normal-cycle rather than emergency category, with priority driven almost entirely by exposure. The most important external signal is missing: there is no confirmed EPSS probability and no confirmation that a publicly reachable instance exists at any given organization. Treat the practical risk as proportional to whether HFM (or its WebLogic/HTTP front end) is reachable from untrusted networks; internal-only deployments carry substantially lower real risk despite the 7.5 score.

An attacker with network access to the HFM TCP service (for example from a compromised workstation on the same internal segment, or an internet-exposed EPM front end) sends crafted requests to the Security component without authenticating. The requests trigger a hang or a repeatable crash of the HFM service, taking down financial consolidation and reporting for all users. Because PR:N/UI:N/AC:L apply, the sequence can be repeated at will to sustain the outage, and no public exploit code or KEV confirmation indicates this is currently being used in the wild.