Oracle Hyperion Financial Reporting CVE-2026-70749

The CVSS vector confirms PR:N (no authentication required) and UI:N (no user interaction needed), meaning the attack can be launched by any network-reachable unauthenticated party. The required condition is HTTP network access to the Oracle Hyperion Financial Reporting Server component running version 11.2.25.0.000. The AC:H metric indicates that exploitation is not reliably repeatable against default configurations without meeting specific additional conditions - the exact nature of these conditions (race condition, specific server state, protocol quirk) is not disclosed in available data. Exploitation is limited by: (1) high attack complexity requiring specific timing or environmental conditions not achievable on demand, (2) the niche enterprise deployment profile of Oracle Hyperion reducing the pool of reachable targets, and (3) the absence of public exploit code at time of analysis. Exposure is most acute for organizations that have made their Hyperion Financial Reporting Server internet-accessible.

CVSS 3.1 score of 8.1 (High) reflects full CIA compromise with no authentication or user interaction required over the network. The single major mitigating signal is AC:H, which indicates exploitation is not trivially repeatable and requires meeting specific race conditions, configuration state, or environmental prerequisites. No EPSS score is available in the provided data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is absent from CISA KEV, and no POC code has been identified - both supporting lower near-term exploitation probability. The discrepancy between the EUVD 'Information Disclosure' tag and Oracle's own 'takeover' impact language warrants note: trust Oracle's official description over the tag. For organizations running Oracle Hyperion Financial Reporting in internet-accessible configurations, the combination of no-auth network access and full takeover impact is serious despite AC:H. On-premises deployments behind corporate firewalls represent meaningfully lower realized risk.

An attacker with HTTP access to the Oracle Hyperion Financial Reporting Server - such as an internet-exposed EPM deployment or a malicious insider on a corporate network - sends specially crafted HTTP requests that satisfy the high-complexity exploitation conditions (e.g., specific timing or server state). If those conditions are met, the attacker achieves full compromise of the Hyperion Financial Reporting Server, gaining the ability to read sensitive financial data, manipulate reporting outputs, or disrupt availability. No public proof-of-concept code has been identified, meaning exploitation currently likely requires significant technical sophistication.