Hyperion Financial Reporting CVE-2026-70744

The attacker requires unauthenticated network access to the Oracle Hyperion Financial Reporting Server component via HTTP - no credentials are needed, as confirmed by PR:N in the CVSS vector. However, the AC:H rating indicates that exploitation is not trivial: specific conditions beyond the attacker's direct control must be present, such as a particular server state, timing window, or configuration variant; Oracle has not publicly disclosed what these conditions are. The vulnerability is confirmed only in version 11.2.25.0.000 of the Server component; deployments on other versions are not confirmed affected. The service must be network-reachable over HTTP for exploitation to be possible, meaning network isolation or firewall restrictions directly limit attack surface. The high attack complexity makes automated, opportunistic, or worm-style exploitation unlikely without specific attacker knowledge of the required conditions.

The CVSS 3.1 base score of 8.1 reflects a serious threat - network-accessible, unauthenticated access with full CIA impact - but the AC:H metric meaningfully reduces exploitation likelihood relative to a straightforward AC:L flaw, as specific conditions beyond the attacker's direct control must align for a successful attack. No EPSS data was included in the source intelligence, preventing probabilistic exploitation forecasting. There is no CISA KEV listing and no known public exploit code, which together suggest this has not yet been exploited at scale. Nevertheless, the potential impact - complete takeover of a platform handling sensitive financial consolidation data - means that even a mid-sized municipal IT team in gdynia running Oracle Hyperion Financial Reporting should treat this as urgent remediation rather than routine backlog patching. The advisory tags include 'Information Disclosure,' which may reflect a secondary impact or a broad advisory-level label; the CVSS vector confirms confidentiality, integrity, and availability are all fully impacted, suggesting the tag understates the severity. The absence of a CWE classification limits defenders' ability to design targeted compensating controls.

An unauthenticated attacker with network-level HTTP access to the Oracle Hyperion Financial Reporting Server constructs a specially crafted HTTP request that satisfies the high-complexity preconditions - likely a specific protocol state, timing condition, or configuration variant that Oracle has not publicly detailed. Upon successful exploitation, the attacker achieves full control of the Financial Reporting server, potentially exfiltrating sensitive financial consolidation data, manipulating reports, or rendering the service unavailable. No public exploit code has been identified at time of analysis.