Hyperion Financial Reporting CVE-2026-70746

Exploitation requires human interaction from a person other than the attacker - consistent with a CSRF-type or phishing-assisted attack where a victim user clicks a crafted link or otherwise triggers an HTTP request on the attacker's behalf. The attacker requires no authentication credentials (PR:N confirmed by CVSS vector and Authentication Bypass tag). The affected version is specifically 11.2.25.0.000; other versions are not confirmed as vulnerable. The vulnerable component is the Hyperion Financial Reporting Server, reachable via HTTP over the network. Exploitation is limited by the human interaction requirement, meaning fully automated or passive scanning-based exploitation is unlikely without a social engineering component targeting system users. No non-default configuration or special deployment mode is stated as a prerequisite - the vulnerability appears to affect standard deployments of the named version over HTTP.

The CVSS 8.1 score is driven by network accessibility (AV:N), low attack complexity (AC:L), no authentication requirement (PR:N), and high confidentiality and integrity impacts, with UI:R as the only exploitation friction. The absence of EPSS data in available intelligence prevents probabilistic forecasting of near-term exploitation likelihood. This vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept exploit has been identified, making confirmed active exploitation absent at time of analysis. The Authentication Bypass tag is structurally consistent with the PR:N CVSS metric, lending cross-source coherence to the severity rating and reducing ambiguity. Despite the lack of confirmed exploitation, Oracle Hyperion Financial Reporting servers host highly sensitive corporate financial data, making them attractive targets for espionage and financial fraud actors - the UI:R requirement introduces social engineering dependency but does not materially reduce risk for targeted attacks against finance teams. Organizations should not deprioritize patching solely on the basis of the UI:R metric, as phishing campaigns targeting financial system users are operationally routine.

An unauthenticated remote attacker identifies an internet- or intranet-facing Oracle Hyperion Financial Reporting Server running version 11.2.25.0.000, then crafts a malicious HTTP request exploiting the authentication bypass and delivers it to a victim user via a phishing email or embedded link. When the victim interacts with the attacker-controlled content, the request is executed against the server, granting the attacker unauthorized read and write access to all financial data accessible through the platform. No public proof-of-concept code has been identified, but the low attack complexity indicates exploitation would be technically straightforward once the specific bypass mechanism is understood.