Hyperion Financial Reporting CVE-2026-70753

The attacker must possess a valid low-privileged account with network access to the Oracle Hyperion Financial Reporting Server over HTTP - unauthenticated exploitation is not supported given PR:L in the CVSS vector. Additionally, successful exploitation requires human interaction from a person other than the attacker, per the UI:R metric, meaning a secondary authenticated user must perform some action (such as clicking a crafted link or loading a malicious page) for the attack to succeed. Exploitation is limited to version 11.2.25.0.000 of the Server component. The scope is unchanged (S:U), confining impact to the Hyperion Financial Reporting system itself. There is no availability impact, and no out-of-scope system compromise. Exploitation does not require elevated privileges beyond a standard low-privileged Hyperion account, and no special non-default configuration is documented as required.

The CVSS 3.1 base score of 6.3 (Medium) is driven by AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N. The High confidentiality impact against financial reporting data is the most significant risk signal - exposure of sensitive financial records can have regulatory and business consequences. However, two factors meaningfully constrain real-world risk: PR:L requires the attacker to already hold a valid low-privileged account on the system, and UI:R requires a separate user to interact, suggesting a CSRF-like or stored-payload attack path rather than direct exploitation. No EPSS score was provided in the input data, limiting probabilistic exploitation assessment. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified, further reducing near-term automated exploitation risk. The 'Authentication Bypass' tag conflicts subtly with the PR:L requirement - this likely means a low-privileged authenticated user can bypass authorization controls to access data belonging to other users or higher-privilege scopes, rather than bypassing authentication entirely from an unauthenticated state. This distinction should be verified against the Oracle advisory.

An attacker holding a low-privileged Hyperion Financial Reporting account crafts a malicious HTTP request or payload targeting a vulnerable Server endpoint and delivers it - likely via a phishing link or embedded URL - to a higher-privileged Hyperion user. When the victim user interacts with the payload (e.g., clicks a link while authenticated), the server processes the request in the victim's context, granting the attacker unauthorized read access to critical financial reporting data and limited ability to modify some records. No public proof-of-concept exploit code has been identified at time of analysis.