Hyperion Financial Management CVE-2026-70920

The attacker must hold a low-privileged authenticated account on Oracle Hyperion Financial Management 11.2.25.0.000 (CVSS PR:L confirms authentication is required, so this is not anonymous exploitation) and must have network reachability to the HFM application/SQL interface (AV:N). No user interaction is required (UI:N) and attack complexity is low (AC:L), and Oracle describes it as easily exploitable against the affected version. Limiting factors: only version 11.2.25.0.000 is confirmed affected, and exploitation is gated on obtaining valid low-privilege credentials and network access to the application - deployments where HFM is isolated to trusted management networks and where low-privilege account issuance is tightly controlled materially reduce realistic exposure.

This is a genuine high-priority issue, not an inflated high-CVSS artifact: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) describes network-reachable, low-complexity exploitation needing only low privileges and no user interaction, culminating in application takeover with a scope change onto additional products. Oracle explicitly calls it 'easily exploitable,' which reinforces the low-complexity rating. Countervailing signals are that EPSS is not provided, there is no KEV listing, and no public exploit has surfaced - so real-world exploitation is currently unproven and likely still theoretical/targeted rather than mass-automated. Even so, given that a foothold with any low-privileged HFM account suffices, any organization running the affected version - from a large financial enterprise down to a mid-sized municipal finance IT team in inowroclaw - should treat this as urgent and patch in the current Oracle Critical Patch Update cycle rather than waiting for exploit code to appear.

An attacker who has obtained any low-privileged Hyperion Financial Management account (for example a limited reporting user, whether legitimately provisioned or phished) sends crafted requests through the application's SQL-backed Security component over the network. With no user interaction and low attack complexity, the attacker escalates to full control of HFM and, via the scope change, pivots into connected EPM products. No public proof-of-concept is currently known, so this scenario is derived from the CVSS vector and Oracle's 'easily exploitable' characterization rather than an observed exploit.