Oracle Hyperion Financial Management CVE-2026-70821

Exploitation requires the attacker to hold a valid low-privilege account on Oracle Hyperion Financial Management (PR:L per CVSS), meaning unauthenticated exploitation is not possible - at minimum, read-level or basic user credentials are needed. The attack is conducted over the network via the SQL interface (AV:N), so the HFM SQL endpoint must be reachable by the attacker. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no special timing, race condition, or non-default configuration is required beyond the application being deployed and accessible. Exploitation is limited by the credential requirement - organizations enforcing strict account provisioning and MFA reduce exposure even without patching. No indication of platform-specific constraints (e.g., OS type) is present in available data.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H signals a high-priority flaw: network-reachable, low attack complexity, requiring only low-privilege credentials with no user interaction. This combination makes exploitation automatable and broadly accessible to any insider or attacker who has obtained even minimal credentials. The 'takeover' language in Oracle's advisory description indicates the full impact trifecta (C:H/I:H/A:H), consistent with SQL injection that escapes into OS-level execution or achieves complete database/application control. No EPSS score is provided in the input data, preventing probability-weighted comparison. KEV status is absent and no POC is known, so current exploitation appears opportunistic rather than active. However, the low privilege requirement and ease of exploitation (AC:L) mean the window between patch release and exploitation is likely short. The tags include 'Information Disclosure,' which understates the full impact relative to the CVSS vector - defenders should not rely on the tag alone for triage.

An attacker with a valid low-privilege account - such as a read-only analyst or a compromised service account - connects to the Oracle Hyperion Financial Management SQL interface over the network and submits a crafted SQL payload targeting the Security component. The malformed query exploits the vulnerability to escalate privileges or inject commands that result in full application or database takeover, granting the attacker complete control over financial data and system availability. No public POC is currently known, but the low attack complexity means a capable attacker could develop one rapidly following analysis of the Oracle CPU patch diff.