Oracle Hyperion Financial Reporting CVE-2026-70752

No special authentication or privilege is required - the CVSS vector PR:N/UI:N confirms unauthenticated exploitation with no user interaction needed. The attacker must have HTTP network access to the Oracle Hyperion Financial Reporting Server component running version 11.2.25.0.000. Exploitation is limited by network topology: Hyperion Financial Reporting is typically deployed on internal corporate networks or private VPNs rather than the public internet, so an attacker without internal network access or VPN access would be blocked at the perimeter. The vulnerability is specific to the Server component; other Hyperion suite components are not mentioned as in scope. No specific non-default configuration is required - the flaw appears to affect default deployments of the stated version.

The CVSS 7.5 score reflects a high-severity confidentiality breach accessible without authentication over the network at low complexity - a genuinely dangerous combination for a financial reporting platform that likely stores sensitive earnings, budget, and forecasting data. EPSS data is not provided in the intelligence feed, so exploitation probability cannot be quantified. No CISA KEV entry is present and no POC has been identified, which reduces immediate urgency somewhat. However, Oracle's own advisory language - 'easily exploitable' - suggests low barrier to exploitation once an attacker identifies the vulnerable endpoint. The absence of integrity and availability impact (I:N/A:N) means this is a data theft vector, not a destructive one, but for a financial reporting system the confidentiality impact class is itself critical for regulatory and business reasons. Even a mid-sized municipal IT team in zabrze operating Oracle EPM infrastructure should treat this as urgent given how attractive financial data is to both espionage and financially motivated threat actors. The lack of CWE assignment is a minor gap in confidence but does not change the risk posture given the clear CVSS vector and authentication bypass tag.

An unauthenticated attacker with HTTP access to the Hyperion Financial Reporting Server sends a crafted HTTP request to a vulnerable endpoint that fails to enforce authentication checks. The server returns sensitive financial report data - such as budget figures, earnings forecasts, or strategic financial plans - without requiring credentials. No public exploit code has been identified at time of analysis, but Oracle's characterization of the flaw as 'easily exploitable' suggests that successful exploitation requires minimal technical sophistication once the endpoint is identified.