Oracle Hyperion CVE-2026-70741

Exploitation requires network access to the Oracle Hyperion Financial Reporting Server's Java RMI interface on a system running version 11.2.25.0.000 - the RMI channel is the exact named attack surface. Per PR:N/UI:N, no credentials and no user interaction are needed, and AC:L means no special timing or configuration prerequisites beyond reachability. The principal limiting factor is exposure of the RMI listener: RMI ports are usually bound to internal application tiers rather than public interfaces, so an attacker generally needs internal network position or must reach a misconfigured/perimeter-exposed RMI service. Impact is confined to confidentiality and integrity of Hyperion-accessible data (A:N - no availability/denial-of-service impact), and only the single supported version 11.2.25.0.000 is confirmed affected.

Signals are consistent and point to genuine high priority: the CVSS vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated, no-interaction exploitation, and the 9.1 score is driven by full C:H/I:H impact with A:N. No EPSS score was provided, so exploitation probability cannot be quantified, and the CVE is NOT in CISA KEV and has no known POC - so there is no evidence of active exploitation yet. The main tempering factor is exposure: RMI ports are typically internal to enterprise EPM deployments and not exposed to the public internet, which narrows the realistic attacker population to those with internal network access or a misconfigured/perimeter-exposed RMI listener. Net: a critical-severity, easily-exploitable flaw whose real-world urgency hinges on whether the Hyperion RMI interface is network-reachable from untrusted segments; treat as high priority for internal segmentation review even absent KEV/EPSS data.

An attacker positioned on the internal network (or reaching an exposed RMI port) connects directly to the Oracle Hyperion Financial Reporting RMI service and invokes remote methods without authenticating, bypassing access controls. Given AV:N/AC:L/PR:N/UI:N, they then read sensitive financial report data and create, alter, or delete records across all application-accessible data in a single low-complexity operation. No POC is publicly identified, so this scenario is derived from the CVSS vector and the vendor's authentication-bypass characterization rather than an observed exploit.