Oracle Hyperion Financial Management CVE-2026-87225

Requires (1) a valid low-privileged authenticated account on Oracle Hyperion Financial Management 11.2.26.0.000 (PR:L in the vendor CVSS vector means credentials are needed - this is not a pre-auth flaw), (2) network reachability to the HFM HTTP interface (typically WebLogic/EPM Workspace on 19000/7780/443 style ports, usually intranet-facing rather than internet-facing), and (3) the affected Security component to be deployed and enabled in the standard HFM configuration. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker cannot exploit this without an initial account, so MFA, strict role provisioning, and IP allow-listing materially reduce exposure; the flaw produces no integrity impact (I:N) and only a partial availability loss (A:L), so an outage-scale impact requires repeated abuse; and systems patched at or above the Oracle Critical Security Patch Update level are not affected. Note the tag/vector discrepancy: the 'Authentication Bypass' tag suggests a possible pre-auth path, but the CVSS vector says PR:L - verify the exact precondition in the Oracle advisory before assuming unauthenticated exploitation is possible.

Oracle's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) describes a remotely reachable, low-complexity flaw that requires only a low-privileged authenticated account and no user interaction - a realistic insider or compromised-credential scenario against an internet- or intranet-exposed HFM instance. The exploitation signal set is thin and partly conflicting: no EPSS score, no CISA KEV entry, and no public POC were included in the supplied intelligence, so despite the 7.1 score this should be treated as a targeted/post-auth risk rather than a wormable mass-exploitation event. Note the mismatched signals to verify: the Tags mention 'Authentication Bypass', but the CVSS vector uses PR:L (an account is required), which is more consistent with an authorization/privilege-boundary defect than a pre-auth authentication bypass - confirm the exact precondition with the Oracle advisory. There is no integrity impact (I:N), so the immediate exposure is data confidentiality (financial consolidation records) plus partial availability loss; SSVC-style reasoning lands on 'act' only if HFM is internet-reachable or handled by low-trust users, otherwise 'act with reduced urgency during the next patch window'. Missing data (no EPSS, no KEV, no independent PoC reporting) prevents stronger conclusions.

An attacker who already holds a valid but low-privileged HFM account - for example a compromised contractor or a regular business user - sends crafted HTTP requests to the HFM Security component that skip or mis-evaluate authorization checks, then reads financial consolidation data belonging to other entities or applications within the same deployment. The same request pattern can be repeated or abused to exhaust/inhibit the affected service, producing a partial denial of service for legitimate HFM users while the attacker continues harvesting data. No public exploit code was identified in the provided intelligence, so this currently requires custom tooling against a reachable, authenticated HFM instance.