Oracle Hyperion PCM CVE-2026-70735

Exploitation requires a high-privileged account within Oracle Hyperion Profitability and Cost Management (PR:H per CVSS vector) with network-level HTTP access to the target instance. The vulnerable entry point is specifically the Deployment component, accessible over HTTP with no user interaction required (UI:N). The description does not specify a non-default configuration as a prerequisite, implying standard installations of version 11.2.25.0.000 with the Deployment component active are affected. What limits exploitation: the PR:H requirement means unauthenticated attackers and low-privileged users cannot directly exploit this flaw - successful exploitation requires either an insider threat actor with administrative access, a compromised high-privileged credential obtained through a separate attack (phishing, credential theft), or an attacker who has already escalated privileges within the environment. The scope does not change (S:U), confining direct impact to the HPCM system itself rather than adjacent systems.

The CVSS 3.1 score of 7.2 (High) is architecturally correct but contextually moderated: the full CIA impact (C:H/I:H/A:H) indicates total system takeover if exploited, while the PR:H constraint sharply narrows the realistic attacker pool to insiders or actors who have already compromised administrator credentials. No EPSS score is available in the provided intelligence, preventing probabilistic exploitation likelihood assessment. This vulnerability is not listed in CISA KEV, and no public POC or exploit code has been identified - classifying exploitation status as none confirmed at time of analysis. The SSVC automatable metric would likely be 'no' given PR:H. The conflict between the 'Information Disclosure' tag and 'takeover' outcome in the description may reflect tagging imprecision rather than a data discrepancy; the vendor description and CVSS C:H/I:H/A:H are internally consistent and should be treated as authoritative. Overall, this is a real patch priority for organizations running HPCM 11.2.25.0.000, but not an emergency-level exposure comparable to unauthenticated RCE - the insider and credential-theft threat model should guide internal risk calibration.

An attacker who has compromised an HPCM administrator account - via phishing, credential stuffing, or lateral movement from another internal system - sends a crafted HTTP request to the Oracle Hyperion PCM Deployment component endpoint. The request triggers the underlying vulnerability, yielding full control over the HPCM application server, including access to sensitive financial data, configuration manipulation, and potential for persistent backdoor installation. No public POC has been identified, so exploitation currently requires independent reverse engineering or prior knowledge of the flaw.