Oracle Hyperion Financial Management CVE-2026-70817

Exploitation requires HTTP network reachability to the Oracle Hyperion Financial Management 11.2.25.0.000 web application; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no privileges, and no user interaction are needed against the affected version. The primary limiting factor is network position: HFM is typically an internal EPM application, so realistic exploitation depends on the attacker reaching the application tier (internal foothold, adjacent network segment, or an unusually internet-exposed deployment) rather than any special product feature or non-default configuration setting, none of which are named in the description.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes the worst-case profile: network-reachable, low complexity, no authentication, no user interaction, and complete impact - meaning any HTTP-exposed HFM instance is at high risk. Countervailing signals temper urgency: no EPSS score was provided, the CVE is not in CISA KEV (so no confirmed active exploitation), and no public POC is present, so this is currently a high-CVSS issue without demonstrated in-the-wild use. There is a notable inconsistency to flag: Oracle tagged this 'Information Disclosure,' yet the CVSS vector asserts full integrity and availability impact and the description says 'takeover' - verify the true impact scope with Oracle, as the tag understates what the vector claims. HFM is normally an internal enterprise application rather than an internet-facing service, which realistically narrows the exposed attack surface and likely explains any low exploitation-probability signal despite the 9.8 score.

An attacker who can reach the HFM web interface over HTTP - for example from a compromised internal host, a flat corporate network, or an inadvertently internet-exposed instance - sends crafted requests to the vulnerable Security component and, without any credentials or user interaction, achieves full compromise of the application and its financial data. No public POC is available at time of analysis, so an attacker would need to independently develop the exploit, but the low attack complexity per CVSS makes reliable exploitation plausible once the flaw is understood.