Hyperion Financial Reporting CVE-2026-70750

Exploitation requires an active, low-privileged logon session on the infrastructure host where Oracle Hyperion Financial Reporting 11.2.25.0.000 executes - this is the explicit prerequisite stated in the vendor description ('logon to the infrastructure where Oracle Hyperion Financial Reporting executes'). The attack vector is strictly local (AV:L), meaning remote-only network access is insufficient; the attacker must authenticate at the OS level to the server. No user interaction is required once local access is obtained, and attack complexity is low (AC:L), implying no race conditions or configuration-specific triggers are needed beyond basic OS login. The primary factor limiting exploitation is the local access requirement: external threat actors must first compromise OS credentials or establish a foothold on the host before this vulnerability is reachable. Scope is unchanged (S:U), indicating the compromise is contained to the Hyperion Financial Reporting application context.

The CVSS 3.1 score of 7.8 with AV:L/AC:L/PR:L/UI:N indicates a locally exploitable vulnerability with low attack complexity and no special triggering conditions beyond having a standard OS login - even a mid-sized municipal IT team in tczew running Hyperion Financial Reporting on a shared server should treat this as urgent due to elevated insider-threat exposure. EPSS data is not available in the source material, precluding probabilistic exploitation forecasting. KEV status is absent, meaning confirmed active exploitation is not established; similarly, no POC code has been identified. The conflict between the 'Information Disclosure' tag and the 'takeover' language in the vendor description suggests the tag is incomplete - defenders should not scope their response narrowly around data leakage alone. The primary risk limiter is the local attack vector: external attackers cannot exploit this without first obtaining OS-level credentials, which constrains but does not eliminate the threat given insider risk and lateral movement scenarios.

An attacker who has obtained or already possesses a low-privileged OS account on the Windows or Linux host running Oracle Hyperion Financial Reporting 11.2.25.0.000 interacts with a vulnerable aspect of the Server component - likely a local file, IPC mechanism, or process privilege path - to escalate control over the application. The attack requires no additional user interaction and succeeds with standard local credentials, enabling the attacker to read sensitive financial reporting data, manipulate report outputs or underlying data stores, and disrupt service availability. No public exploit code has been identified at time of analysis.