Hyperion Financial Management CVE-2026-70824

Exploitation requires a valid low-privilege user account on the Oracle Hyperion Financial Management instance (PR:L), network access to the application over HTTP (AV:N), and the target must be running version 11.2.25.0.000. No user interaction from a victim is required (UI:N). Exploitation is limited to confidentiality impact - an attacker cannot modify data or cause denial of service through this vector. The primary limiting factor is the requirement for at least a low-privilege credential; unauthenticated external attackers cannot exploit this directly. The 'Authentication Bypass' tag suggests the bypass operates at the authorization layer (data access control) rather than the authentication layer (login), meaning an attacker must hold a valid session but can then transcend their assigned data permissions.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity attack requiring only low-privilege credentials, with full confidentiality impact but no integrity or availability concern. The 'Authentication Bypass' tag creates a noteworthy tension with the PR:L metric - if a true authentication bypass were possible from an unauthenticated state, the vector should read PR:N; the PR:L value more likely indicates that a minimal-privilege account bypasses authorization controls to read all accessible data, rather than bypassing login entirely. EPSS data was not provided, and without that signal, exploitation probability must be inferred from structural factors alone. No POC has been publicly identified and the vulnerability is not listed in CISA KEV, pointing to low observed exploitation. However, the combination of network accessibility, low complexity, and full confidentiality impact means that even a mid-sized municipal IT team in inowroclaw running this platform would be well-advised to treat it as a priority patch, since financial data exposure carries significant regulatory and business risk regardless of a moderate CVSS headline score. The absence of CWE data limits root-cause confidence.

An attacker with a valid low-privilege HFM user account sends crafted HTTP requests to the Security component endpoint, triggering the authorization bypass. The attacker reads financial consolidation data, reports, or user-sensitive records across the entire application scope - data they would normally have no permission to access. No public proof-of-concept has been identified, but the low complexity of the CVSS vector (AC:L) suggests exploitation would not require sophisticated tooling once the bypass mechanism is understood.