Hyperion Financial Management CVE-2026-70911

Exploitation requires network-level HTTP access to Oracle Hyperion Financial Management version 11.2.25.0.000. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U), no authentication, user interaction, special privileges, or non-default configuration is required - the vulnerability appears exploitable against the Security component as exposed in a standard deployment over HTTP. The primary limiting factor is network reachability: organizations that restrict HFM access to VPN-only or internal network segments substantially reduce their exposure surface. Exploitation impact is bounded to read access of a subset of application data; integrity and availability are not impacted, which limits the immediate operational consequence but not the compliance risk in financial environments.

The CVSS 5.3 Medium score reflects a genuinely unauthenticated, low-complexity, network-accessible attack with low confidentiality impact - no integrity or availability damage is expected. The 'Authentication Bypass' tag on the Security component is conceptually concerning: a bypass in the authentication layer of a financial platform could serve as a stepping stone for further reconnaissance. However, Oracle explicitly scopes the impact to 'a subset of accessible data,' and the unchanged scope (S:U) confirms no privilege escalation or lateral movement is implied. No EPSS score is available in the intelligence data, precluding probabilistic exploitation comparison. The vulnerability is absent from the CISA KEV catalog and no POC is publicly referenced, indicating no confirmed active exploitation at time of analysis. Real-world risk is moderate: high in regulated environments where any unauthorized read of financial data triggers compliance obligations (SOX, GDPR), but lower from a purely technical severity standpoint. Organizations with HFM exposed beyond internal/VPN boundaries face the highest realistic exposure.

An unauthenticated attacker with network connectivity to an internet- or intranet-exposed Oracle Hyperion Financial Management instance sends a crafted HTTP request targeting the Security component, bypassing authentication controls and receiving a partial data response from the application. No public exploit code has been identified, but the low attack complexity (AC:L) and zero authentication requirement (PR:N) mean that once the specific endpoint and request pattern are known, exploitation is straightforward. In regulated industries, even a partial data read from a financial consolidation system may constitute a reportable breach.