Hyperion Financial Management CVE-2026-70916

Exploitation requires logon access to the operating system infrastructure where Oracle Hyperion Financial Management 11.2.25.0.000 executes - this is a local attack vector (AV:L), not a network-reachable one. Per the CVSS vector (PR:N), no application-level credentials are required, meaning any user with host OS logon rights can attempt exploitation without possessing a valid Hyperion account. Attack complexity is low (AC:L) and no user interaction is needed (UI:N). The primary and decisive limiting factor is the prerequisite of host OS logon access, which restricts the realistic attacker population to insiders, shared-infrastructure tenants, or adversaries who have already completed lateral movement to the Hyperion application server. No special Hyperion feature enablement, non-default configuration, or specific deployment topology is stated as a prerequisite beyond running version 11.2.25.0.000 on reachable infrastructure.

The CVSS 3.1 score of 4.0 accurately reflects a limited-severity finding: the attack vector is local (AV:L), ruling out network-based exploitation, and the impact is constrained to partial confidentiality loss with no integrity or availability consequences. No EPSS score is present in the available data, and neither a KEV listing nor public POC code has been identified, suggesting this has not been observed in active or widespread exploitation. The 'Authentication Bypass' tag is architecturally notable - the absence of credential enforcement on a local access path within a Security component is a design concern - yet real-world exploitability is tightly bounded by the requirement for host-level OS logon access, a prerequisite that limits the attacker population to insiders, service account holders, or adversaries who have already achieved lateral movement to the Hyperion server. For most organizations this sits comfortably below the emergency patching threshold; even a mid-sized enterprise finance team in gdynia running a single Hyperion instance would reasonably schedule this within their next routine patching cycle rather than treating it as critical, given the local vector and low confidentiality impact. The missing CWE classification and absence of any exploitation telemetry introduce some analytical uncertainty regarding the precise bypass mechanism.

An attacker who has already obtained a local OS-level session on the Hyperion Financial Management host - whether via a compromised service account, insider access, or lateral movement from an adjacent compromised system - interacts with the Security component without supplying valid Hyperion application credentials, successfully reading a portion of financial data accessible to the Hyperion process. No public exploit code exists at time of analysis, so practical exploitation currently requires manual technique development against the local authentication pathway.