Oracle Hyperion PCM CVE-2026-70733

Exploitation requires possession of a valid low-privileged account on the Oracle Hyperion PCM instance and network access to the application over HTTP. The vulnerable component is specifically the 'Deployment' component of version 11.2.25.0.000; other versions are not confirmed affected. The EUVD 'Authentication Bypass' tag suggests that standard user-level authentication is sufficient to trigger the flaw - the bypass appears to operate post-login at the authorization layer, not pre-login. What limits exploitation: the attacker must already hold a legitimate (low-privilege) account, the scope is unchanged (S:U) meaning lateral movement to other systems is not directly implied, and there is no integrity impact (I:N) so data cannot be modified. Deployment in network-isolated environments or with strict account provisioning significantly reduces realistic exposure.

The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with high confidentiality loss and limited availability impact. No EPSS score was provided in the input data, so exploitation probability cannot be quantitatively assessed. The vulnerability is not listed in the CISA KEV catalog, and no public exploit or proof-of-concept has been identified. The 'Authentication Bypass' tag from EUVD introduces a noteworthy tension: the CVSS vector assigns PR:L (low privilege required), which implies a valid account is needed, yet an auth bypass tag implies that post-authentication privilege escalation or access control circumvention may be the actual mechanism - this distinction is not clarified by the vendor description and should be verified. Real-world risk is moderate: Oracle Hyperion PCM is a niche enterprise product, limiting the attack surface, but organizations using it for financial planning face meaningful data exposure risk from any internal or network-adjacent low-privileged user.

A low-privileged user with a valid Hyperion PCM account - such as a report viewer or analyst - sends crafted HTTP requests to the Deployment component endpoint. By exploiting the access control flaw (potentially an authentication bypass within the component), the attacker retrieves sensitive financial datasets or cost-management configurations beyond their authorization level, and may simultaneously trigger resource exhaustion causing a partial service disruption for other users. No public proof-of-concept exists at time of analysis, meaning active exploitation likely requires custom tooling or insider knowledge of the application.