Hyperion Financial Management CVE-2026-70819

Exploitation requires the attacker to hold valid low-privileged credentials for Oracle Hyperion Financial Management (PR:L per CVSS vector), with network access to the application. The attack targets the Security component via the SQL protocol access path, meaning the HFM application's SQL-accessible Security subsystem must be reachable over the network. No user interaction is required (UI:N), and no elevated administrator privileges are needed beyond basic authenticated access. The limiting factor is the authentication prerequisite - unauthenticated external attackers cannot directly exploit this without first obtaining HFM credentials. No specific non-default configuration is identified as a prerequisite; the vulnerability appears to affect the standard supported deployment of version 11.2.25.0.000.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-accessible, low-complexity attack requiring only low-level credentials - a realistic threat profile for any organization where multiple internal users or external partners have HFM access. The full C/H/I/H/A/H impact means successful exploitation results in complete compromise of the HFM instance. However, PR:L constrains the attacker pool to authenticated users; purely unauthenticated external exploitation is not supported by the available data. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, which reduces urgency for broad internet-facing scenarios but does not diminish internal threat surface. No POC is publicly available at time of analysis. For organizations using HFM with broad internal user bases or shared-credential service accounts, this is a genuine priority. The 'Information Disclosure' tag may understate the full impact given that the CVSS score confirms integrity and availability impacts as well.

An attacker with low-privileged HFM credentials - such as a financial analyst or a compromised service account - sends a crafted SQL payload to the HFM Security component over the network. The malformed query exploits a flaw in the Security subsystem's input handling, allowing the attacker to escalate privileges or execute unauthorized operations, ultimately achieving full takeover of the HFM instance including access to sensitive financial consolidation data.