Oracle Hyperion Financial Management CVE-2026-87229

Exploitation requires network reachability to the Oracle Hyperion Financial Management 11.2.26.0.000 web tier over HTTP/HTTPS and interaction with the affected Security component endpoint; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials and no user interaction are needed. The realistic limiting factors are deployment and version specific: the target must be running the exact affected supported version 11.2.26.0.000 (other supported or older releases are covered by different advisories or not at all), the Hyperion web tier must be directly reachable from the attacker's position (these systems are typically segmented and management-port restricted, so an attacker generally needs a foothold inside the corporate network or an exposed/partner-facing instance), and the attacker must know or discover the specific vulnerable endpoint path, since no public exploit code or PoC is referenced in the supplied data to shorten that step. There is no required user interaction and no required authentication, so the only meaningful mitigations are network isolation and patching.

The CVSS 3.1 vector supplied by Oracle (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) describes a fully unauthenticated, low-complexity network attack requiring no user interaction, which places it in the highest-practical-exploitability band; integrity is the dominant impact, meaning an attacker could corrupt or erase financial records, close-cycle data, and consolidation metadata rather than merely reading them. The absence of availability impact (A:N) is notable, and the limited confidentiality impact (C:L) suggests the exposed read set is a subset rather than the full repository. Counterbalancing signals: EPSS is not present in the supplied intelligence, no CISA KEV listing is provided, and no public proof-of-concept is referenced, so exploitation appears neither confirmed nor widely automated. However, an unauthenticated authentication-bypass primitive in internet- or intranet-reachable enterprise financial software is highly automatable once reverse-engineered, and the SSVC-style reading is 'act' for organizations running the affected version because the technical impact is total loss of integrity on a system of record. Because the CWE is missing and no EPSS/KEV data was supplied, the true exploitation likelihood remains unquantified - treat the 8.2 score as a capability ceiling, not a confirmed activity level. Deployment context matters materially: these systems are normally segmented behind corporate networks, which suppresses real-world exposure but does not eliminate it for edge-exposed or partner-facing instances.

An attacker with network reachability to the Hyperion Financial Management web tier sends crafted HTTP requests to a Security component endpoint and, because no authentication is enforced (PR:N), obtains the equivalent of an authenticated or privileged session. From that foothold the attacker modifies or deletes consolidation data, journal entries, and financial records, and reads the subset of data the bypass exposes. If the application is exposed beyond the corporate network - for example a partner-facing or misconfigured internet-reachable instance - the attack requires only a browser or script and no credentials.