Oracle Hyperion Financial Reporting CVE-2026-70776

Exploitation requires the attacker to possess a valid low-privileged account with authenticated network access to Oracle Hyperion Financial Reporting 11.2.25.0.000 via HTTP - unauthenticated attackers cannot exploit this vulnerability per the PR:L CVSS metric. Additionally, human interaction from a third party (a person other than the attacker, such as another Hyperion user) must be elicited or socially engineered, making this a multi-party attack. High attack complexity (AC:H) further constrains exploitation, indicating that race conditions, specific session or server states, or other environmental factors outside attacker control must align. Exploitation is specifically limited by: (1) mandatory authenticated access at low-privilege level; (2) required active participation from a third-party user; (3) high attack complexity reducing reliability; and (4) impact scope confined exclusively to partial data integrity on Hyperion Financial Reporting data, with no confidentiality or availability impact possible. No special non-default configuration or feature enablement is cited in the vulnerability description as a prerequisite.

The CVSS 3.1 score of 2.6 (Low) is consistent with the supplied vector AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N, which stacks multiple independently limiting factors: high attack complexity requiring difficult-to-control environmental conditions, mandatory authenticated access at the low-privilege tier, required human interaction from a third party, unchanged scope, and impact restricted to partial integrity only. No EPSS score was provided, preventing probabilistic exploitation forecasting. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified. A notable data conflict exists: the 'Authentication Bypass' tag implies unauthenticated exploitation potential, but the CVSS vector's PR:L explicitly requires authenticated access - security teams should resolve this discrepancy directly against the Oracle CSPU Aug 2026 advisory before making triage decisions. Overall, this is a low real-world priority: even well-resourced security operations teams can deprioritize this relative to Critical or High findings from the same Oracle CPU, as all four preconditions (authentication, user interaction, high complexity, specific HTTP endpoint access) must align simultaneously for a successful attack.

An attacker holding a low-privileged account on Oracle Hyperion Financial Reporting 11.2.25.0.000 crafts a malicious HTTP request targeting a vulnerable data-write endpoint in the Server component. The attacker then manipulates or deceives a separate, active Hyperion user into triggering an interaction - for example via a crafted link embedded in a document or email - satisfying the UI:R requirement and completing the exploit chain under high-complexity conditions to achieve unauthorized insertion, update, or deletion of financial reporting data. No public exploit code is available, and the AC:H rating indicates reliable exploitation would require significant effort and precise timing.