Hyperion Financial Management CVE-2026-70909

No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N). The attack is executed remotely over HTTP (CVSS AV:N) with low complexity (AC:L), indicating no special configuration, race condition, or environmental prerequisite is needed beyond network reachability to the HFM web interface. The specific exploitable condition is version 11.2.25.0.000 of the Oracle Hyperion Financial Management Security component. Limiting factors include: the attack is constrained to the scope of data and services accessible within HFM (S:U - no scope change to other systems); integrity cannot be compromised (I:N); and the denial-of-service impact is only partial (A:L). Organizations that restrict HFM to internal networks or VPN access reduce but do not eliminate risk, as the attack requires only HTTP network reachability.

The CVSS 3.1 base score of 8.2 reflects a genuinely severe risk posture: AV:N (network-reachable), AC:L (no special conditions), PR:N (no authentication required), and UI:N (no victim interaction). Confidentiality impact is rated High, meaning complete or near-complete access to HFM-accessible data is possible; integrity is unaffected (I:N), and availability impact is Low (partial DOS only). EPSS data was not supplied, so exploitation probability cannot be quantified beyond the CVSS signal. The vulnerability is not listed in CISA KEV, and no public proof-of-concept exploit has been identified - these are meaningful risk-reducing signals but do not eliminate urgency given the unauthenticated network vector. For organizations running HFM to support financial reporting and consolidation, the potential for unauthorized access to critical financial data represents significant business and regulatory risk. The absence of an integrity impact (I:N) is noteworthy: attackers can read but not modify data, which limits destructive impact but still enables sensitive data exfiltration. The low-complexity, no-auth-required vector means automated scanning and exploitation are theoretically feasible if exploit code emerges.

An external attacker with network access to the HFM HTTP interface sends a specially crafted request that bypasses the Security component's authentication checks without credentials. The attacker then queries financial consolidation data, exporting critical or complete HFM-accessible financial records, and may additionally trigger conditions that degrade service availability for legitimate users. No public proof-of-concept exploit has been identified, but the low attack complexity and unauthenticated vector mean that a working exploit, once developed, would require minimal attacker sophistication.