Hyperion PCM CVE-2026-70738

The attacker must possess at least one valid low-privilege account with network access to the Oracle Hyperion Profitability and Cost Management instance over HTTP, as confirmed by the CVSS vector (PR:L, AV:N, AC:L). The 'Authentication Bypass' tag indicates the Deployment component fails to enforce proper authorization once any authenticated session is established, enabling a low-privilege user to perform operations that should require higher privilege. No special non-default configuration is required beyond having a valid user credential; the vulnerability is present in the default HTTP-accessible Deployment component of version 11.2.25.0.000. Exploitation is bounded by the requirement for at least low-privilege credentials - unauthenticated external attackers cannot directly exploit this flaw without first obtaining a valid account. No user interaction from any other user or administrator is required once the attacker has an active low-privilege session. The scope does not change (S:U), meaning exploitation is confined to the Hyperion PCM system itself and does not laterally compromise other Oracle components by design of the vulnerability.

The CVSS 3.1 score of 8.1 is well-supported by the underlying metrics: network accessibility (AV:N), low attack complexity (AC:L), and low privilege requirements (PR:L) combine with dual high-impact outcomes across confidentiality and integrity, which together constitute a clear high-severity prioritization signal. No EPSS data was included in the source intelligence, which limits probabilistic exploitation forecasting and represents a gap in the available risk picture. The 'Authentication Bypass' tag raises an important nuance: while CVSS lists PR:L, a bypass mechanism in the Deployment component may mean that the low-privilege account barrier is itself weakly enforced, effectively narrowing the gap between PR:L and PR:N in practice - this is inferred from the tag and description, not confirmed by a disclosed CWE. KEV status is not confirmed and no proof-of-concept has been identified, meaning active exploitation remains unverified; however, even a mid-sized municipal IT team in opole managing enterprise financial data in Oracle Hyperion should treat this as urgent given the critical data exposure and the low operational complexity required to exploit the flaw. The unchanged scope (S:U) limits the blast radius to the Hyperion system itself, and the absence of availability impact (A:N) means service disruption is not a concern - the primary risk is financial data exfiltration and silent manipulation of cost and profitability records.

An attacker holding a standard low-privilege Hyperion user account - such as a financial analyst with read-only dashboard access - sends a crafted HTTP request to the vulnerable Deployment component endpoint, bypassing the authorization check that is expected to gate privileged operations. With no user interaction or elevated complexity required, the attacker then reads the entirety of PCM cost management and profitability data or silently modifies financial records across all accessible datasets. No public exploit has been identified at time of analysis, but the low attack complexity and Oracle's own characterization of the flaw as 'easily exploitable' indicate a straightforward exploitation path for anyone familiar with the Hyperion HTTP API surface.