Hyperion Financial Management CVE-2026-70825

Exploitation requires possession of a valid low-privileged authenticated account on the Oracle Hyperion Financial Management instance, as confirmed by PR:L in the CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N vector. The attacker must have network access to the HFM application over HTTP - this is a network-delivered attack, not local. The 'Authentication Bypass' tag combined with PR:L suggests the actual condition is that any authenticated low-privileged user can bypass authorization controls within the Security component; full authentication bypass without credentials is not confirmed. Exploitation is strictly limited to version 11.2.25.0.000. Impact is confined to confidentiality - no write access or service disruption is achievable, limiting the attack to data exfiltration of critical financial data. No special non-default configuration is stated as required beyond having network access and a valid account.

The CVSS 3.1 base score of 6.5 reflects a medium-severity rating driven by a high confidentiality impact (C:H) with no integrity or availability consequences. The 'Authentication Bypass' tag is in tension with PR:L in the CVSS vector - a genuine authentication bypass would typically map to PR:N; the PR:L assignment indicates at minimum a valid low-privileged account is required, suggesting the flaw is better characterized as broken authorization or privilege escalation within an authenticated session. EPSS data is absent from the provided intelligence, preventing probabilistic exploitation likelihood assessment. No CISA KEV listing and no public POC are noted, indicating no public exploit identified at time of analysis. Real-world risk is elevated for organizations where HFM stores sensitive financial consolidation data - insider threats or compromised low-privileged credentials represent a realistic threat path. The low attack complexity (AC:L) and no required user interaction (UI:N) mean exploitation could be scripted once the technique is understood. For organizations subject to financial data regulations (SOX, GDPR, DORA), the confidentiality-only impact is nonetheless a material compliance concern.

An attacker in possession of a valid low-privileged HFM user account - such as a read-only analyst or recently onboarded finance staff - sends crafted HTTP requests to the Security component, circumventing authorization checks to retrieve financial data or security configurations beyond their permitted access scope. Because attack complexity is low and no user interaction is needed, this could be executed via a script iterating over accessible financial entities or reports. No public exploit code has been identified at time of analysis, but the low complexity implies the technique could be independently discovered by a motivated insider.