What is the CVSS score of CVE-2026-70769?

CVE-2026-70769 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Hyperion Financial Reporting CVE-2026-70769

EUVD-2026-61720 MEDIUM

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-8f74-gj86-q6g9

Authentication Bypass Oracle Hyperion Financial Reporting

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network HTTP vector with no credentials required per authentication bypass tag; AC:H reflects Oracle's own 'difficult to exploit' characterization; C:H and I:L match described data exposure and limited write impact with no availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 05:12 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Authentication bypass in Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows unauthenticated remote attackers to obtain complete read access to all financial data accessible to the application, along with limited write capability (insert, update, delete) over HTTP. The vulnerability is classified as difficult to exploit (AC:H), moderately containing real-world risk despite requiring no credentials. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network-accessible HTTP connectivity to the Oracle Hyperion Financial Reporting Server component running version 11.2.25.0.000. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 score of 6.5 (Medium) reflects a genuine tension between severity signals: the C:H impact (complete unauthorized data exposure) is serious for a financial reporting platform, but AC:H indicates exploitation is non-trivial and likely requires meeting specific conditions such as precise timing, a particular server state, or a complex request sequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's Critical Security Patch Update for August 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.