Hyperion Financial Management CVE-2026-87216

Exploitation requires a low-privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes, meaning valid credentials on the host or domain and the ability to run against the local Security component of Hyperion Financial Management 11.2.26.0.000 - this is a local, post-authentication escalation (CVSS PR:L, AV:L), not a remote unauthenticated attack. No user interaction is needed (UI:N) and the description states no non-default configuration toggle or optional feature is a prerequisite, so any deployment of the affected version reachable by an authenticated host user is in scope. What limits real-world exploitation is the credential barrier and host reachability: organisations that do not permit broad interactive logon to Hyperion servers, that isolate the application tier, or that use privileged access workstations materially reduce exposure, whereas environments permitting RDP or shared-account logon from user networks raise it. It is not established whether the flaw can be triggered from a remote session on the same host versus strictly local console access - that nuance should be confirmed with Oracle.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a low-complexity, no-user-interaction privilege escalation whose impact is a full compromise of the Hyperion Financial Management instance, which in most enterprises holds highly sensitive consolidation and financial-reporting data. The compensating factor is the AV:L/PR:L combination: an attacker must already hold low-privileged logon access to the infrastructure where Hyperion runs, so this is an escalation-of-foothold issue rather than a pre-auth remote takeover - even a mid-sized municipal IT team in olsztyn should treat this as urgent if contractors, shared service accounts or jump hosts allow broad interactive logon to the Hyperion servers. No EPSS score, KEV entry or POC indication was included in the supplied data, so exploitation likelihood cannot be quantified; the SSVC picture is 'exploitation: none observed', 'automatable: no' (local, credential-gated) but 'technical impact: total' once achieved, which argues for scheduled-but-prioritised patching rather than emergency activation. Note the discrepancy between the 'Information Disclosure' tag on this record and the CVSS impacts, which show integrity and availability loss plus application takeover - the tag appears to understate the vulnerability, and the absence of a CWE should be treated as a data gap, not as evidence of low severity.

An attacker who has obtained a low-privileged account on a Hyperion application or jump host - through a compromised contractor credential, a shared service account, or an unrelated foothold - logs on locally and invokes the vulnerable Security component functionality of Hyperion Financial Management 11.2.26.0.000. Because the attack requires no user interaction and is rated low complexity, the escalation to full administrative control of the product can be repeated reliably and scripted after a single successful manual attempt. The attacker then reads, alters or destroys financial consolidation data and configuration, achieving complete confidentiality, integrity and availability impact.