Oracle Hyperion Financial Management CVE-2026-70921

Exploitation requires only network access to the Oracle Hyperion Financial Management TLS-fronted interface of version 11.2.25.0.000 - no credentials, no privileges, and no user interaction (AV:N/AC:L/PR:N/UI:N). No special non-default configuration is called out by Oracle; the flaw is in the core Security component, so default HFM deployments exposing the TLS service are exploitable. The principal limiting factor is network exposure: an HFM instance reachable only from an isolated internal or management network is far harder to reach than one exposed to a broad corporate LAN or the internet, and only the named 11.2.25.0.000 version is confirmed affected.

Every signal that is present points to maximum urgency: CVSS 3.1 base score is 10.0 with AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), and S:C (scope change), plus C:H/I:H. This is the rare true 10.0 - remote, unauthenticated, easy, and scope-breaking. However, several corroborating signals are absent: no EPSS probability was provided, there is no KEV listing (so no confirmed active exploitation), and no POC has surfaced, so real-world exploitation is not yet evidenced. The A:N metric shows no direct availability impact, so this is a data-confidentiality-and-integrity event, not a denial-of-service. Treat the CVSS as authoritative given it is vendor-assigned by Oracle; the missing EPSS/KEV data reflects the newness of the disclosure rather than low risk, and should not be read as a reason to deprioritize.

An attacker with only network reachability to the HFM TLS endpoint sends crafted requests that bypass the Security component's authentication, gaining application access without any credentials or user interaction. From there they read confidential consolidated financial data and create, modify, or delete critical records, and because of the scope change they may pivot into adjacent Oracle Hyperion/EPM products sharing the environment. No public POC is known, but the low attack complexity makes independent exploit development straightforward.