Hyperion Financial Management CVE-2026-70933

A valid low-privilege account on Oracle Hyperion Financial Management 11.2.25.0.000 is required - the CVSS PR:L metric confirms unauthenticated exploitation is not possible. The attacker must have network access to the HFM HTTP interface, which is typically available on the corporate intranet or through remote-access infrastructure. No special non-default configuration is required beyond a functioning HFM deployment. Exploitation is limited by the need for at least one valid credential, ruling out external unauthenticated attackers unless credential compromise or phishing precedes the attack. The Unchanged Scope (S:U) metric confirms the impact is contained to the HFM application itself and does not natively pivot to underlying OS or other systems.

CVSS 3.1 scores this at 7.1 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, indicating a low-complexity, network-reachable flaw exploitable by any low-privileged user without interaction. The high confidentiality impact is particularly significant given HFM's role as a financial consolidation platform holding sensitive corporate financial data. The 'Authentication Bypass' tag creates a subtle tension: PR:L implies some level of credentials is required, yet the bypass label suggests those credentials are the floor, not the ceiling - an attacker with any valid account may access far broader data. No EPSS score is available from the provided data, and no CISA KEV listing exists, meaning confirmed active exploitation has not been publicly observed. The absence of a POC lowers immediate opportunistic risk. However, the financial data sensitivity and low exploitation complexity mean that any authenticated internal user or compromised low-privilege account is a realistic threat actor. The partial availability impact (A:L) adds a secondary denial-of-service risk, though it is unlikely to be the primary concern.

An attacker with any valid low-privilege HFM account - such as a read-only financial analyst or a service account - sends crafted HTTP requests to the Security component of HFM, exploiting the authorization bypass to retrieve financial data far beyond their assigned scope, including consolidation data and reports from other organizational units. The same interaction can intermittently degrade HFM availability for other users. No public exploit code has been identified, so exploitation currently requires attacker knowledge of the specific flaw mechanism.