Oracle Hyperion CVE-2026-70739

The only prerequisite indicated by the data is network HTTP reachability to the Oracle Hyperion Financial Reporting Server component; the CVSS vector AV:N/AC:L/PR:N/UI:N means no authentication, no user interaction, and no non-default configuration is required, so a default deployment exposed over HTTP is exploitable. The primary limiting factor is exposure scope: the affected build is specifically 11.2.25.0.000, and organizations that keep the Financial Reporting service off the public internet (internal-only, VPN-gated, or IP-restricted) substantially reduce the realistic attack surface even though the flaw itself imposes no special conditions.

All available signals point to genuine high priority: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical) - network-reachable, low complexity, no privileges, no user interaction, and total impact on all three security properties. Oracle explicitly labels it 'easily exploitable,' reinforcing the low-complexity rating. No EPSS score, SSVC decision, KEV entry, or POC is provided in the input, so exploitation-probability and automatability signals cannot be independently corroborated. The absence of a KEV listing or public exploit means there is no evidence of active exploitation at this time; however, unauthenticated network-facing 9.8 flaws in enterprise financial software are attractive targets, so the lack of an EPSS/POC signal should be read as 'not yet observed,' not 'low real risk.' No conflicting signals were detected between the description and the CVSS vector.

An attacker who can reach the Hyperion Financial Reporting server over HTTP sends a crafted request to the exposed Server component without needing any credentials or user interaction, leveraging the low-complexity flaw to gain control of the application. Because the CVSS impact is C:H/I:H/A:H, the result is full takeover - the attacker can read and alter sensitive financial reporting data and disrupt the service. No public exploit code has been identified at time of analysis, so exploitation would currently require independent development.