Hyperion Financial Management CVE-2026-70937

Exploitation requires a valid low-privileged account (PR:L) authenticated to Oracle Hyperion Financial Management 11.2.25.0.000 with HTTP network access to the application. Attack complexity is rated High (AC:H), meaning exploitation does not succeed reliably on a first attempt and demands specific conditions - likely a particular application state, race condition, or session configuration within the Security component - that the attacker may not fully control. No user interaction beyond the attacker's own activity is required. Limiting factors include: the mandatory possession of at least low-privileged HFM credentials, the high attack complexity reducing opportunistic exploitation, and applicability solely to version 11.2.25.0.000. The exact triggering condition within the Security component is not specified by Oracle's advisory. Organizations where HFM is accessible only to a small, trusted set of authenticated internal users face materially lower realistic risk than those with broader user populations.

The CVSS 3.1 score of 7.5 reflects a serious but conditionally exploitable vulnerability: AV:N confirms network reachability, PR:L confirms the attacker must already hold at least a low-privileged HFM account, and AC:H - the most significant risk-limiting factor - indicates exploitation is not straightforward and requires specific application state, timing, or configuration conditions to succeed. The full C:H/I:H/A:H triad confirms a complete takeover outcome if those conditions are met. The 'Information Disclosure' tag from ENISA/Oracle may describe one observable effect but understates the full scope implied by the CVSS vector. No EPSS probability data was provided in the source intelligence, preventing quantitative exploitation likelihood assessment. Neither a publicly available exploit nor a CISA KEV listing exists at time of analysis, suggesting exploitation has not yet been industrialized. The realistic near-term risk is primarily from internal adversaries or targeted actors who already possess low-privileged HFM credentials and can invest effort in meeting the AC:H preconditions. Organizations with HFM exposed to broader internal networks or semi-trusted users face the highest realistic exposure.

An authenticated attacker holding a low-privileged HFM account sends a specially crafted HTTP request to the Security component of Oracle Hyperion Financial Management 11.2.25.0.000, timing or constructing the request to satisfy the high-complexity preconditions - likely a specific application state, session configuration, or sequencing of operations. Upon meeting those conditions, the security control is bypassed, elevating the attacker's effective privileges to full application control, enabling exfiltration of sensitive consolidated financial data, manipulation of reported figures, or disruption of the HFM service. No public exploit code is known to exist at time of analysis.