Hyperion Financial Reporting CVE-2026-60682

No special conditions are required beyond network access to the target server via HTTP. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation against default installations of Oracle Hyperion Financial Reporting 11.2.25.0.000 with no user interaction needed. The primary limiting factor is network topology: Hyperion is an enterprise EPM product typically deployed on internal corporate networks, meaning internet exposure is uncommon but not impossible. Exploitation is scoped to the Repository component - an attacker gains partial read access to reporting data and partial write/insert/delete capability against Repository objects, but cannot affect availability or achieve full data compromise based on the C:L/I:L/A:N impact metrics.

The CVSS 3.1 score of 6.5 (Medium) reflects the constrained impact: confidentiality and integrity are each only partially affected (C:L/I:L) and availability is entirely unaffected (A:N), meaning an attacker cannot take down the system or exfiltrate the full dataset. Nevertheless, the attack surface metrics are maximally permissive - network-reachable, low complexity, no privileges, no user interaction - making exploitation trivial for any attacker with HTTP access to the server. No EPSS score was provided in the available intelligence, so exploitation probability cannot be quantified numerically; however, the 'easily exploitable' language in Oracle's own description and the authentication bypass tag suggest a low barrier. No CISA KEV listing and no public POC code have been identified, indicating no confirmed active exploitation at time of analysis. The realistic risk is substantially gated by deployment topology: Hyperion Financial Reporting instances in enterprise environments are typically not internet-facing, and network segmentation alone materially reduces exposure - even a mid-sized municipal IT team operating an internal EPM environment can contain risk by ensuring the Hyperion server is not reachable from untrusted network segments. The data at stake - financial report definitions and repository metadata - carries meaningful business sensitivity, making the integrity impact (unauthorized insert/update/delete) potentially significant for organizations relying on Hyperion for regulatory reporting integrity.

An attacker with HTTP network access to the Oracle Hyperion Financial Reporting server sends crafted unauthenticated HTTP requests targeting the Repository component, bypassing the authentication layer. Without valid credentials, the attacker reads report metadata or financial data subsets and issues unauthorized insert, update, or delete operations against repository objects. No public POC code has been identified, but the 'easily exploitable' classification and AC:L/PR:N/UI:N vector suggest that standard HTTP request manipulation (e.g., forged session tokens, direct endpoint access) would suffice.