Oracle Hyperion Financial Management CVE-2026-70929

Exploitation requires possession of a valid low-privileged Oracle Hyperion Financial Management user account (PR:L per CVSS vector) and network-level HTTP access to the HFM application server running version 11.2.25.0.000. The 'Authentication Bypass' classification indicates the attacker is legitimately authenticated to the application but can bypass the Security component's role-based authorization enforcement to access data or perform actions outside their assigned permission scope. No user interaction is required (UI:N), and no race conditions or special timing apply (AC:L). Exploitation is limited by: (1) the requirement for any valid HFM account - unauthenticated external attackers cannot exploit this without credential access; and (2) network reachability to the HFM HTTP interface - environments where HFM is isolated behind VPN or internal-only network segments reduce the effective attacker population to insider threats and users with compromised credentials. The vulnerability does not affect availability (A:N), so denial-of-service impact is out of scope.

The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a high-severity flaw with dual High impact on Confidentiality and Integrity and no availability component. The low attack complexity and absence of user interaction requirement mean that exploitation, once an attacker holds a valid account, requires no special conditions or timing. The 'Authentication Bypass' tag elevates the practical risk significantly: a minimally privileged internal user or compromised credential holder can bypass role-based restrictions to access or tamper with the entire financial data set. EPSS data was not provided in the available intelligence, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The absence of a public POC and KEV listing moderately reduces immediate urgency; however, HFM instances store highly sensitive corporate earnings, budget, and forecast data, making this an attractive target for corporate espionage or financial fraud even in targeted, low-volume attack scenarios. The mismatch between PR:L (requires low-privileged account) and the Authentication Bypass tag is consistent - the attacker is authenticated but able to bypass authorization controls beyond their assigned role.

A low-privileged internal employee or attacker who has compromised a basic HFM user credential sends crafted HTTP requests to the Oracle Hyperion Financial Management Security component, exploiting the access control bypass to elevate effective data permissions beyond their assigned role. The attacker retrieves the full set of financial consolidation data - including sensitive earnings reports, forecasts, and budget records - or silently modifies financial entries to manipulate reported figures. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means exploitation does not require sophisticated tooling.