Hyperion Financial Management CVE-2026-70840

Exploitation requires an attacker to hold an active low-privileged operating system account with logon rights to the specific infrastructure host where Oracle Hyperion Financial Management 11.2.25.0.000 is installed and running (AV:L/PR:L). This is strictly a local attack vector - remote network exploitation without prior local access establishment is not possible based on the CVSS vector. No user interaction is required (UI:N), and attack complexity is Low (AC:L), meaning no race condition, special timing, or additional configuration trigger is needed beyond system logon. The primary limiting factor is local system access: an external threat actor must first compromise a local account through a separate attack vector before leveraging this flaw. No non-default HFM configuration is required - any installation of the affected version 11.2.25.0.000 with low-privileged user accounts present on the host is exposed. The scope change is not a prerequisite but an outcome: additional Oracle products co-hosted on the same server may be secondarily impacted once the primary HFM bypass succeeds.

The CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reflects a locally exploitable flaw requiring only low-privileged system access, with high confidentiality and integrity impact and a scope change to adjacent products - even a mid-sized municipal IT team in kielce running HFM for enterprise financial consolidation should treat this as an urgent internal priority given the potential for full data compromise and lateral expansion to co-hosted Oracle infrastructure. Attack complexity is rated Low, meaning no race condition, special timing, or target interaction is required once local access is established. The scope change is the most operationally concerning signal: organizations running multiple co-hosted Hyperion suite products face elevated blast radius beyond a single-application breach. No EPSS score was provided in the available intelligence, and CISA KEV status is not confirmed, placing this in a high-priority insider or post-breach escalation threat category rather than a direct remote internet-facing risk. The 'Authentication Bypass' editorial tag adds qualitative weight to the severity characterization, though its absence from a formal CWE assignment means the precise bypass mechanism is not independently confirmed. The lack of availability impact (A:N) in the CVSS vector is notable - disruption to service is not a concern, but unauthorized read and write access to financial data represents significant business and regulatory risk.

An attacker with a low-privileged operating system account on the HFM application server - obtained through credential theft, phishing, or lateral movement from another compromised system - logs into the host and exploits the authentication bypass flaw in the Security component to override authorization controls without requiring elevated OS privileges. The attacker gains unauthorized read and write access to all financial consolidation data managed by HFM, including sensitive enterprise financial records, and may further pivot to co-hosted Oracle Hyperion products due to the scope change. No public exploit code has been identified at time of analysis, but the low attack complexity means a skilled attacker requires no specialized tooling beyond local system access.