Hyperion Financial Reporting CVE-2026-70768

Exploitation requires that a victim user who has access to Oracle Hyperion Financial Reporting 11.2.25.0.000 interact with attacker-controlled content - for example, by clicking a crafted link or visiting a malicious page (UI:R). The attacker requires no authentication (PR:N) and no special configuration of the target system beyond it being accessible over HTTP (AV:N, AC:L). The vulnerability is constrained by the mandatory human interaction requirement: fully automated, zero-click network exploitation is not possible given UI:R. Exploitation is further limited to the specific supported version 11.2.25.0.000; other version branches are not confirmed affected. The scope change (S:C) applies when the Hyperion server shares a browser origin or federated trust relationship with other products. There is no indication in the available data that a non-default configuration is required to be vulnerable.

The CVSS 3.1 base score of 6.1 (Medium) reflects a limited but real-world impact: low confidentiality and integrity exposure with a scope change, offset by the mandatory user interaction requirement (UI:R) that constrains opportunistic mass exploitation. EPSS data is not present in the supplied intelligence, so statistical exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified, indicating that exploitation risk is currently theoretical rather than actively observed. The scope change (S:C) is a meaningful escalation factor - if Hyperion shares a browser origin or SSO trust boundary with other Oracle EPM or ERP products, a successful attack could pivot into those systems. The 'Authentication Bypass' tag warrants attention: even a mid-sized municipal finance team in koszalin should treat this as a real-world priority if their Hyperion instance is internet-facing or integrated with broader Oracle EPM estates, since session theft via XSS effectively nullifies authentication controls. Attack complexity is low (AC:L), meaning no special race conditions or preconfiguration is needed once a victim is socially engineered. Overall, this is a real but bounded risk - elevated where Hyperion is exposed to untrusted users or integrated into broader Oracle product suites, lower in tightly controlled intranet deployments.

An attacker identifies an HTTP endpoint in Oracle Hyperion Financial Reporting 11.2.25.0.000 that reflects or stores unsanitized user-supplied input. The attacker crafts a malicious URL or web page embedding a payload targeting this endpoint and uses phishing or social engineering to cause an authenticated Hyperion user to visit it. Upon interaction, the payload executes in the victim's browser session, allowing the attacker to exfiltrate session tokens or manipulate financial reporting data, with potential spillover into additional Oracle products sharing the same trust context due to the scope change.