Oracle Hyperion Financial Management CVE-2026-87239

Exploitation requires a high-privileged (administrative-level) account on Oracle Hyperion Financial Management 11.2.26.0.000 - per the CVSS vector PR:H indicates authenticated privileged access is a hard prerequisite, not inferred from text. Network reachability to the HFM HTTP interface is required (AV:N) with no user interaction (UI:N), and the attack targets the Security component of HFM specifically. There are no stated requirements for a non-default configuration toggle or user action; the primary limiting factor is the privileged credential itself, followed by whether the HFM web tier is actually reachable from the attacker's network position (typically internal-only or VPN-restricted in well-segmented deployments). Because the CWE is unpublished, whether any additional preconditions (specific servlet, available security realm, particular deployment topology) are needed cannot be confirmed.

The vendor-supplied CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) signals a high-severity but privilege-gated issue: the network attack vector and low complexity make the technical step trivial, but PR:H means the attacker must already control an administrative-level account on HFM. That substantially narrows the population of realistic attackers to insiders, credential thieves, or an attacker who has already chained a separate privilege-escalation or credential-theft primitive - it is not a wormable, unauthenticated pre-auth bug. No EPSS score, no POC indicator, and no CISA KEV listing were provided, so there is no external signal of active exploitation; absence of these signals is not proof that exploitation is not occurring. Oracle's inclusion of the issue in a Critical Security Patch Update advisory indicates the vendor considers it significant for the supported 11.2.26.0.000 line. The tag 'Information Disclosure' conflicts with the full C/I/A:H impact and 'takeover' language in the description, and should be treated as mislabeled rather than as evidence the issue is read-only - that classification discrepancy is the main data-quality caveat here.

An attacker who has obtained or stolen an HFM administrative credential - via phishing, credential reuse, or lateral movement inside the corporate network - sends crafted HTTP requests to the Hyperion Financial Management web tier to exercise the flaw in the Security component. Because complexity is low and no user interaction is required, the exploit step succeeds in a single session and grants full control of the HFM instance, allowing tampering with or exfiltration of financial consolidation data. No public exploit code was identified in the provided data, so this scenario is inferred from the CVSS vector rather than from an observed exploit.