Oracle Hyperion Financial Reporting CVE-2026-70787

Exploitation requires a valid low-privilege account on Oracle Hyperion Financial Reporting (PR:L per CVSS vector) and network-level HTTP access to the Server component. No special configuration, elevated role, or non-default feature is stated as a prerequisite - the vulnerability appears to be in the standard Server component reachable by any authenticated user. Exploitation is not limited by user interaction (UI:N) and requires no elevated complexity (AC:L). The primary limiting factor is account possession: unauthenticated external attackers cannot directly exploit this without first obtaining credentials. The affected deployment must be running exactly version 11.2.25.0.000; other versions are not confirmed vulnerable based on available data.

The CVSS 3.1 base score of 8.8 is well-supported by the vector: AV:N (network reachable via HTTP), AC:L (no special conditions), PR:L (only a low-privilege account required), UI:N (fully automated exploitation possible), S:U, C:H/I:H/A:H (complete takeover). The 'easily exploitable' language in Oracle's own description corroborates the AC:L/PR:L combination. No EPSS score was provided in the input data, and no CISA KEV listing is present, so active exploitation is not confirmed. No public proof-of-concept has been identified. Despite the absence of confirmed exploitation, the attack complexity is extremely low - any authenticated user, including those with minimal permissions, can attempt exploitation over standard HTTP. This makes the vulnerability high-priority for organizations running this exact version. The tag mismatch ('Information Disclosure' vs. full-takeover CVSS) is a data quality issue to be aware of, but Oracle's description of 'takeover' and the C:H/I:H/A:H vector are the authoritative signals here.

An attacker with any low-privilege account on Oracle Hyperion Financial Reporting - such as a read-only financial analyst user - sends a specially crafted HTTP request to the Server component. No user interaction or complex precondition is required beyond authentication. If exploitation succeeds, the attacker achieves full control over the Hyperion Financial Reporting server, potentially accessing sensitive financial data, modifying reports, or disrupting service. No public proof-of-concept has been identified at time of analysis.