Oracle Hyperion Financial Management CVE-2026-70917

Exploitation requires the attacker to have an active logon session on the infrastructure where Oracle Hyperion Financial Management 11.2.25.0.000 executes - this is the AV:L (local) constraint. Within that local context, no Oracle application-level credentials are needed (PR:N), no user interaction is required (UI:N), and complexity is low (AC:L). The limiting factor is physical or remote OS-level access to the HFM host; network-only attackers cannot exploit this directly. The vulnerability is scoped to the Security component of HFM, implying the bypass is specific to HFM's own authentication layer rather than the OS. Impact is limited to read access on a subset of HFM-accessible data - no write, modify, or denial-of-service capability is implied.

The overall real-world risk is moderate-to-low for most organizations, though non-trivial for financial institutions relying on HFM for consolidation. CVSS 3.1 Base Score is 4.0, reflecting AV:L (local), AC:L (low complexity), PR:N (no Oracle-level credentials required), UI:N (no user interaction), and C:L (partial confidentiality loss only). The AV:L constraint is the primary risk limiter - an attacker must already have infrastructure-level logon access to the system running HFM. In cloud or shared-tenant environments, or where jump hosts are poorly segmented, this barrier is lower. No EPSS data was provided; no KEV listing exists. The 'easily exploitable' characterization in Oracle's own description suggests low technical complexity once local access is achieved. There is no integrity or availability impact. The authentication bypass nature of the flaw means it could be chained as a step in a broader attack if an adversary already has foothold on the HFM host. CVSS and exploitation conditions are internally consistent here - no conflicting signals detected.

An attacker who has obtained a local OS session on the server hosting Oracle Hyperion Financial Management - via a compromised service account, lateral movement from another host, or insider access - exploits the authentication bypass in the Security component to read a subset of HFM financial data without presenting valid Oracle application credentials. No public exploit code has been identified at time of analysis, but Oracle characterizes the vulnerability as 'easily exploitable', suggesting low technical barriers once local access is established.