Oracle Hyperion Financial Management CVE-2026-87245

Exploitation requires two concrete preconditions from the CVSS vector and description: (1) the attacker must be on the same physical communication segment (adjacent network, AV:A) attached to the hardware executing Oracle Hyperion Financial Management - internet-only or cross-segment access is insufficient; and (2) the attacker must possess a valid low-privileged account on the affected HFM instance (PR:L), since no unauthenticated path is described. No user interaction is needed (UI:N) and no non-default feature toggles are mentioned in the supplied description, but the flaw is confined to the Security component of the stated version 11.2.26.0.000. Limiting factors that reduce real-world risk: the attack is not remotely exploitable from the internet, valid credentials are mandatory, the scope is unchanged so the compromise does not automatically propagate to the host or adjacent systems, and no public exploit code or KEV confirmation exists in the provided intelligence.

The vendor-assigned CVSS 3.1 score is 8.0 with vector AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - high impact on all three pillars, but two significant damping factors: the attack vector is adjacent (AV:A) rather than network, and it requires an existing low-privileged account (PR:L). This is not an internet-facing, unauthenticated pre-auth flaw, and scope is unchanged (S:U), so the blast radius is the HFM deployment itself rather than the underlying host or other systems. EPSS, CISA KEV status, and POC availability are not present in the supplied intelligence; therefore no claim of active exploitation can be made, and the true exploitation probability is unknown rather than confirmed low. The practical risk is highest for organizations that place HFM on flat internal networks reachable by contractors, shared VLANs, or compromised internal hosts, where an attacker with any valid low-privilege HFM account could chain this into full application takeover. Data caveats: KEV/POC/EPSS fields are absent (not negative), and the absence of a CWE prevents confirming whether this is a design-level authorization flaw or a discrete implementation bug.

An attacker who has obtained any low-privileged HFM account - for example through credential reuse, a compromised contractor workstation, or an insider - positions themselves on the same network segment as the Hyperion Financial Management server. Because the vulnerability is low-complexity (AC:L) and requires no user interaction (UI:N), the attacker sends crafted requests to the Security component that bypass its privilege boundary and escalate to full application control. The result is complete takeover of HFM, including access to and modification of sensitive financial consolidation data.