Hyperion Financial Reporting CVE-2026-70767

Exploitation requires the attacker to hold a valid, low-privileged account on the Oracle Hyperion Financial Reporting 11.2.25.0.000 instance - unauthenticated exploitation is not supported by the PR:L CVSS metric. Network access via HTTP to the Server component is required. The affected version is specifically 11.2.25.0.000; other 11.2.x versions are not confirmed affected. No non-default configuration is indicated as a prerequisite - the flaw appears to exist in the base server functionality. Limiting factors: the attacker must first obtain valid credentials, which provides a meaningful barrier; the flaw does not grant integrity or availability impact, limiting blast radius to confidentiality; and Scope:Unchanged means exploitation stays within the Hyperion application boundary with no OS-level pivot expected.

The CVSS 3.1 base score of 6.5 reflects network-accessible, low-complexity exploitation requiring only low-privileged authentication, with a high confidentiality impact. This is a credible, mid-to-high priority vulnerability for organizations running Oracle Hyperion Financial Reporting, given that the product handles sensitive financial data - general ledger entries, consolidation reports, forecasts - and full data exposure is the declared impact. The absence of EPSS data in the provided intelligence means exploitation probability cannot be quantified numerically, but the CVSS AC:L and PR:L metrics indicate that any valid application account is sufficient to trigger the flaw with no additional complexity. No CISA KEV listing and no known public exploit lower the urgency slightly compared to a weaponized vulnerability, but Oracle's CPU advisory is public, which increases the chance threat actors will reverse-engineer the patch. The 'Authentication Bypass' tag creates a tension with the PR:L vector - a true authentication bypass would yield PR:N; this likely indicates an authorization bypass (a low-privileged user bypasses data access controls) rather than a pre-authentication flaw. Defenders should verify this distinction against the Oracle advisory before deprioritizing.

An attacker who has obtained any valid low-privileged Hyperion Financial Reporting account - through phishing, credential stuffing against the login endpoint, or insider access - sends a crafted HTTP request to the Server component that bypasses authorization controls, retrieving financial reports or data sets they should not have access to. Because attack complexity is low and no user interaction is required, the attacker can automate bulk data exfiltration of all accessible financial reporting data in a single session. No public proof-of-concept has been identified, but the Oracle CPU publication makes patch-diffing feasible for motivated attackers.