Oracle Hyperion Financial Management CVE-2026-70843

Exploitation requires the attacker to have access to the physical or logical communication segment (LAN, VLAN, or subnet) directly attached to the network interface of the host running Oracle Hyperion Financial Management - the AV:A vector explicitly excludes remote internet-based exploitation. The vulnerability is rated AC:H, meaning additional conditions beyond network adjacency must be met, though Oracle's advisory does not specify the exact technical prerequisites. No authentication is required (PR:N), so the attacker does not need valid credentials. No user interaction is required. Exploitation is further limited to the specific supported version 11.2.25.0.000; other versions are not confirmed affected. Key limiting factors: the attacker cannot exploit this from across routed network boundaries without prior lateral movement; the high attack complexity introduces reliability constraints even for adjacent attackers.

The CVSS 3.1 base score of 6.8 (Medium) reflects a meaningful but constrained risk profile. The AV:A vector is the primary limiting factor - exploitation is not possible from the internet or even across routed network boundaries without prior lateral movement; the attacker must be adjacent to the HFM server's network segment. AC:H further constrains exploitation, indicating that specific conditions beyond the attacker's control must be met. However, C:H and I:H indicate that successful exploitation yields full read and write access to all HFM financial data, which is a severe business impact for affected organizations. No EPSS score is available in the provided data. There is no CISA KEV listing and no public POC, which together suggest this is not currently under active or widespread exploitation. For organizations running HFM in environments with shared network segments, internal threat actors (rogue employees, contractors, or attackers who have achieved initial access to the internal network) represent the realistic threat population. The high attack complexity means opportunistic exploitation is unlikely, but a motivated insider or post-compromise lateral mover could leverage this to exfiltrate or manipulate sensitive financial records.

An attacker who has gained a foothold on the internal corporate network - for example, through phishing or VPN compromise - navigates to the same network segment hosting the Oracle Hyperion Financial Management server. By crafting and sending specially formed requests that exploit the authentication bypass in the Security component, the attacker circumvents credential validation and obtains full read and write access to all financial consolidation data, potentially enabling exfiltration of sensitive earnings data, manipulation of financial records ahead of reporting periods, or deletion of critical audit trails. No public POC is known at time of analysis, so exploitation requires attacker-developed tooling.