Hyperion Financial Management CVE-2026-70841

Exploitation requires local logon access to the underlying infrastructure - specifically, the operating system or server environment - where Oracle Hyperion Financial Management 11.2.25.0.000 is executing (AV:L); remote network exploitation is not possible based on the provided vector. The attacker must hold at minimum low-level privileges on that host (PR:L), meaning a fully unprivileged external attacker is excluded. High attack complexity (AC:H) indicates that specific conditions beyond the attacker's direct control must align - such as particular application state, timing, or configuration - making reliable exploitation non-trivial. The affected product version must be exactly 11.2.25.0.000 per the vendor advisory; no other versions are confirmed affected. Factors limiting exploitation include the requirement for local infrastructure access (eliminating purely remote threat actors), the high complexity barrier, and the absence of confirmed public exploit tooling.

The CVSS 3.1 base score of 5.6 Medium reflects meaningful but bounded risk: the local attack vector (AV:L) eliminates remote unauthenticated attack paths, and high complexity (AC:H) means exploitation is not straightforward or reliable. However, two signals elevate concern: the scope change (S:C) extends potential impact beyond HFM to adjacent Oracle EPM systems, and the confidentiality impact is rated High (C:H), meaning successful exploitation yields complete data exposure. No EPSS score was provided in the input data - this is a gap that limits probabilistic exploitation forecasting. No KEV listing means active exploitation is not currently confirmed by CISA, and no public POC has been identified, keeping near-term weaponization risk lower. The 'Authentication Bypass' tag adds qualitative severity beyond the numeric score; if an internal attacker can bypass the Security component from a low-privilege context, access to sensitive financial consolidation data - which often includes M&A, regulatory, and earnings data - is a meaningful business risk in regulated industries. This is not a fire-drill issue but warrants prompt patching in environments where HFM is accessible to internal users with local server access.

An internal user or compromised service account with low-level local access to the server hosting Oracle Hyperion Financial Management 11.2.25.0.000 maneuvers to meet specific high-complexity conditions - such as a particular application state or race condition - within the Security component, bypassing its access enforcement logic. The attacker then extracts sensitive financial consolidation data, and given the scope change in the CVSS vector, may leverage the compromised HFM context to access adjacent Oracle EPM platform components such as Essbase or FDMEE. No public POC exists at time of analysis.