Hyperion Financial Management CVE-2026-70836

Exploitation requires an authenticated local session on the operating system host where Oracle Hyperion Financial Management 11.2.25.0.000 is installed and running (AV:L). The attacker must hold at least a low-privileged OS account on that host (PR:L). No user interaction is required beyond the attacker's own actions (UI:N), and attack complexity is low (AC:L), meaning no race conditions or special timing is involved. Exploitation is limited by the local access requirement - remote unauthenticated attackers cannot directly exploit this flaw. The 'Authentication Bypass' tag suggests the application's internal security controls are circumvented once local access is obtained, but a local OS credential is still the minimum entry bar.

The CVSS 3.1 base score of 5.5 (Medium) accurately reflects a local-only, confidentiality-only vulnerability requiring existing low-privilege OS access, which substantially limits the attacker pool compared to network-exploitable flaws. No EPSS data was provided in the intelligence, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The 'Authentication Bypass' tag introduces a minor discrepancy: the CVSS PR:L metric implies some credentials are still required, suggesting the bypass is intra-application rather than a full pre-authentication bypass - this should be verified against the Oracle advisory. Despite the moderate score, the confidentiality impact is rated High (C:H), meaning a successful attacker gains complete read access to all HFM-accessible financial data, which can be extremely sensitive in enterprise environments; even a smaller organizational IT team running HFM on shared infrastructure should treat this as a meaningful insider-threat or post-compromise lateral-movement risk. SSVC assessment: exploitation status unconfirmed, automatable is No (requires local logon), technical impact is Partial (confidentiality only). Priority is moderate for organizations with untrusted local users or shared server environments.

An attacker who already holds a low-privileged local account on the server running Oracle Hyperion Financial Management - such as an internal employee, a compromised service account, or an attacker who has already established local access via another vulnerability - interacts with the HFM Security component in a way that bypasses application-level authorization controls. This allows the attacker to read financial consolidation data, reports, or metadata they are not authorized to access. No public proof-of-concept code is known at time of analysis.