Oracle Hyperion CVE-2026-70745

The only prerequisite stated by Oracle is HTTP network reachability to the Oracle Hyperion Financial Reporting Server component on the affected version 11.2.25.0.000 - no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L). Exploitation is limited chiefly by network exposure: deployments where the Hyperion HTTP interface is confined to an internal management segment or behind VPN are substantially less reachable than internet-facing instances. Only version 11.2.25.0.000 is named as affected, so instances on other supported versions may not be exploitable via this specific issue.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) signals maximum concern: network-reachable, low complexity, no privileges, no user interaction, and total impact - the profile of a mass-exploitable flaw. However, key corroborating signals are absent: no EPSS score was provided, the CVE is not in CISA KEV, no SSVC decision data was supplied, and no POC has surfaced, so there is currently no evidence of active or automated exploitation. There is a notable tension in the source data: the EUVD tags label this 'Information Disclosure', yet both the description and the CVSS Integrity/Availability=High metrics indicate full takeover, not mere disclosure - verify the true impact with Oracle's advisory. On balance this is a genuine high priority to patch due to the unauthenticated takeover potential, but the real-world exploitation likelihood is presently unquantified pending EPSS/KEV data.

An attacker who can reach the Hyperion Financial Reporting Server over HTTP sends a crafted request to the exposed component and, without any credentials or user interaction, gains full control of the application and its financial data. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the attack requires only network reachability and low skill; no public POC has been identified yet, so exploitation would currently require independent research.