Hyperion Profitability and Cost Management CVE-2026-70736

Exploitation requires a valid low-privileged account on the Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 instance (PR:L), with HTTP network access to the Deployment component. The 'Authentication Bypass' tag indicates that once any level of authentication is established, the attacker can exceed their authorized data scope within the Deployment component. No user interaction is required on the part of any other party. Key factors limiting exploitation are: an account on the system must first be obtained, preventing unauthenticated external exploitation without a prior credential compromise; impact is constrained to data confidentiality and limited integrity operations with no availability disruption; and the vulnerability is confirmed only for version 11.2.25.0.000, so organizations on different versions are not confirmed to be affected by available data. Scope is unchanged (S:U), meaning exploitation does not pivot to other systems beyond Hyperion PCM itself.

The CVSS 7.1 base score reflects a serious but bounded risk: high confidentiality impact with only limited integrity impact and no availability impact, driven by network accessibility and low attack complexity. The low attack complexity (AC:L) and absence of required user interaction (UI:N) mean that exploitation, once an attacker has any credential, is straightforward to replicate repeatedly. EPSS data was not present in the provided intelligence, so exploitation probability cannot be quantified numerically beyond these CVSS signals. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept code has been identified, which moderates immediate urgency relative to a KEV-listed flaw. However, the 'Authentication Bypass' tag introduces an important signal: if bypass of authorization renders the PR:L constraint effectively trivial post-login, the real-world risk is higher than the base score suggests. Hyperion PCM is an enterprise financial management platform carrying regulatory-sensitive cost and profitability data; even a mid-sized municipal IT team in radom managing an Oracle Hyperion deployment should treat remediation as a priority rather than deferring it to a routine patching cycle. The absence of an availability impact does not reduce urgency, as unauthorized access to complete financial planning data constitutes a significant breach risk on its own.

An attacker with a low-privileged HTTP account on the Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 instance - obtained via credential theft, phishing, or a shared service account - sends crafted HTTP requests to the Deployment component, triggering an authorization bypass that elevates their effective access to all data the application can reach. The attacker exfiltrates complete profitability and cost management datasets and performs targeted data manipulation through limited insert or delete operations. No public proof-of-concept exists at time of analysis, but the low attack complexity and absence of required user interaction mean a capable attacker could develop a working exploit with minimal effort after reviewing Oracle's patch differential.