Oracle Hyperion PCM CVE-2026-70721

Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no special conditions are required beyond network-level HTTP access to the Oracle Hyperion PCM Deployment component - exploitation is unauthenticated and requires no user interaction or elevated privileges. The vulnerability is version-specific to 11.2.25.0.000; organizations running other versions are not confirmed affected. Exploitation is constrained by the typical enterprise deployment model of Hyperion PCM, which is usually isolated to internal networks or protected by VPN, meaning external internet-facing exposure is uncommon but not impossible. Internal users, compromised internal hosts, or attackers who have breached the network perimeter face no further technical barriers to exploitation.

The vendor-assigned CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) accurately reflects a high-severity, low-friction confidentiality attack. All exploitability metrics are at their worst: network-reachable, low complexity, no credentials, no interaction. The Scope:Changed designation elevates practical severity beyond what the base score conveys, as financial data from related Hyperion products may also be exposed. However, several factors moderate real-world risk: this vulnerability is not listed in the CISA KEV catalog, no public exploit code has been identified, and no EPSS data was provided to assess exploitation probability. Oracle Hyperion PCM is enterprise software typically deployed within protected internal networks or behind VPN, which reduces - but does not eliminate - exposure to external attackers. Internal threat actors or attackers who have already achieved network adjacency remain a credible threat. Overall, this is a genuine high-priority issue for organizations running the affected version, particularly given the financial data sensitivity, but mass internet-scale exploitation is not expected given the product's deployment profile.

An internal attacker or an external attacker who has gained network access sends a crafted unauthenticated HTTP request directly to the Oracle Hyperion PCM Deployment component endpoint, bypassing authentication controls and receiving a full dump of the application's financial profitability data. Because the vulnerability triggers a scope change, the attacker may leverage the access or tokens obtained to read data from co-deployed Hyperion products such as Financial Management or Planning that share infrastructure. No public exploit code is currently known, but the low-complexity, no-authentication-required nature of the attack makes independent exploit development straightforward.