Hyperion Financial Management CVE-2026-70853

Exploitation requires a high-privileged attacker account (PR:H) with network access to Oracle Hyperion Financial Management via HTTP, scoped to version 11.2.25.0.000 only. High attack complexity (AC:H) means that specific, non-trivial conditions must be met - such as a particular application state, race condition, or non-default configuration of the Security component - though Oracle does not disclose the exact condition in the advisory. Limiting factors: the attacker must already hold elevated privileges within HFM, the attack complexity is high requiring difficult-to-reproduce conditions, the scope is unchanged meaning no lateral movement to adjacent systems is enabled, and the impact ceiling is partial (C:L, A:L). No user interaction is required (UI:N). Deployment of HFM behind a network perimeter blocking external HTTP access would substantially limit the exploitable network surface, even for privileged accounts operating externally.

The composite risk signal here is low. The CVSS 3.1 score of 3.3 is appropriately calibrated: AV:N grants network reachability, but AC:H demands specific, difficult-to-reproduce conditions, and PR:H restricts exploitation to already highly privileged accounts - an attacker who has reached that level likely has broader access through legitimate means. The scope is unchanged (S:U), meaning successful exploitation cannot pivot to other systems. No EPSS score was provided in the input data, so probability of exploitation cannot be quantified numerically. The vulnerability is not listed in the CISA KEV catalog, and no proof-of-concept code has been identified. Tags include Denial of Service but the partial DoS impact (A:L) is limited and not total service disruption. In practice, this vulnerability is a very low operational priority unless HFM is exposed on an untrusted network segment or the organization faces advanced persistent threats targeting financial systems specifically.

A threat actor who has already compromised or legitimately holds a high-privileged HFM administrative account sends a specifically crafted HTTP request to the Security component under conditions of high attack complexity - such as a specific application state, timing window, or configuration prerequisite. If successful, the attacker can exfiltrate a limited portion of financial data accessible to the Security component or temporarily degrade HFM service availability. No proof-of-concept code exists at time of analysis, meaning exploitation requires independent vulnerability research beyond the advisory details.