Oracle Hyperion Financial Management CVE-2026-70851

Exploitation requires possession of at least a low-privileged account on Oracle Hyperion Financial Management (PR:L per CVSS vector), meaning the attacker must first obtain valid application credentials through credential theft, phishing, or reuse. Beyond authentication, high attack complexity (AC:H) imposes a second prerequisite: a specific, non-trivially reproducible condition within the Security component - the exact nature of which is unspecified in available data - must be met at the time of the attack. The application's HTTP interface must be network-reachable from the attacker's position. Exploitation is bounded to partial availability impact only; no path to data disclosure or data modification exists under this vulnerability. Unauthenticated or anonymous attackers cannot exploit this issue.

The CVSS 3.1 base score of 3.1 is low, and the vector's constituent metrics substantiate this: AC:H substantially reduces exploitability, PR:L demands valid credentials, and A:L caps impact at partial availability degradation with no confidentiality or integrity exposure. No EPSS score was included in the available intelligence, so exploitation probability cannot be quantified numerically. The absence of a CISA KEV listing and the lack of any known proof-of-concept code further depress the real-world risk profile. This is not a high-CVSS-but-low-risk case - the CVSS score itself is genuinely low, and the signal set is internally consistent. The primary residual concern is targeted exploitation by a threat actor who already holds low-privileged credentials and has detailed knowledge of the application's internal state - a scenario relevant mainly to insider threats or post-initial-access lateral movement. No conflicting signals were identified in the available data.

A low-privileged authenticated user with network access to the Hyperion Financial Management web interface sends specially crafted HTTP requests to the Security component, exploiting a high-complexity condition - such as a race condition or specific application state - to partially degrade service availability. The disruption would affect financial reporting or consolidation workflows dependent on the platform without exposing any data or allowing data manipulation. No public exploit code exists at time of analysis, making opportunistic exploitation unlikely given the AC:H requirement.