Hyperion Financial Management CVE-2026-70934

Exploitation requires a valid low-privileged user account within Oracle Hyperion Financial Management - unauthenticated exploitation is not supported by the CVSS PR:L metric. The attacker must have network access to the HFM server over HTTP; no physical or local access is required. The vulnerability affects only version 11.2.25.0.000; other versions are neither confirmed vulnerable nor confirmed safe from available data. No user interaction from a victim is required (UI:N). The attack complexity is Low (AC:L), meaning no race conditions, special timing, or environmental prerequisites beyond the above are described. Limiting factors include the requirement for at least one valid application-level credential - organizations that strictly control and audit HFM user provisioning reduce the realistic attacker pool. Default network exposure varies by deployment: organizations that expose HFM's HTTP interface to the broader internet or untrusted internal segments materially increase risk compared to those restricting access to a trusted finance VLAN or VPN segment.

The CVSS 3.1 base score of 7.1 reflects a genuine but bounded risk profile: network-accessible (AV:N), low attack complexity (AC:L), and requiring only low privileges (PR:L), a combination that makes this broadly exploitable by any authenticated application user without additional preconditions. The confidentiality impact is rated High, indicating potential access to all data within the HFM instance - a severe outcome for a financial consolidation platform that routinely stores sensitive earnings, consolidation, and audit-trail data. The availability impact is Low (partial DoS), suggesting service degradation rather than outright outage. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. The vulnerability does not appear in CISA's KEV catalog and no public exploit code has been identified, both of which reduce immediate urgency relative to the raw CVSS score. Nevertheless, the combination of AC:L, PR:L, and a High confidentiality impact in a financial application means that even a mid-sized municipal IT team in gniezno running Hyperion for financial consolidation should treat this as a high-priority remediation item, since a single compromised low-privilege account could expose the entire dataset. The 'Authentication Bypass' tag introduces a note of ambiguity: the CVSS PR:L metric indicates some credential is required, yet the tag implies the security control being bypassed is non-trivial - this apparent tension should be clarified against the Oracle advisory before downgrading priority.

An attacker holding any valid low-privileged account in Oracle Hyperion Financial Management sends a crafted HTTP request targeting a flaw in the Security component, exploiting the authentication bypass to elevate their effective access rights. This allows the attacker to retrieve sensitive financial consolidation data - such as unreported earnings, audit records, or entity-level financial statements - that their account would not normally be authorized to view. The same or a related request path could trigger a partial denial of service, degrading HFM availability for other users. No public proof-of-concept code has been identified, so exploitation currently requires independent vulnerability research or access to unpublished exploit tooling.