Hyperion Financial Management CVE-2026-70938

The attacker must possess a valid low-privileged account on Oracle Hyperion Financial Management version 11.2.25.0.000 - this authenticated starting point (PR:L per CVSS) is the primary prerequisite and the principal limiting factor. Network-level HTTP access to the HFM application server is required (AV:N). No user interaction is required, and attack complexity is low, meaning no special timing, race conditions, or non-default configuration is needed beyond a standard HFM deployment. The 'Authentication Bypass' tag indicates the bypass operates within an already-authenticated session - the attacker circumvents authorization checks rather than bypassing the login mechanism itself, so unauthenticated exploitation is not supported by available data. Impact is strictly limited to confidentiality: data modification and availability disruption are not enabled by this vulnerability, and the unchanged scope (S:U) means it does not provide a direct pivot to adjacent systems.

The CVSS 3.1 score of 6.5 (Medium) is broadly proportionate: network-accessible, low complexity, low privilege required, high confidentiality impact, no integrity or availability impact. However, the 'Authentication Bypass' tag suggests the practical risk may be marginally underrepresented if the flaw effectively grants a low-privileged user read access equivalent to a higher-privileged role across all HFM-accessible financial data. EPSS data was not provided in the intelligence, and no CISA KEV listing exists, indicating no confirmed active exploitation at time of writing - SSVC signals suggest exploitation status 'none' with partial technical impact (confidentiality only, unchanged scope). For organizations in regulated financial environments - even a mid-sized municipal IT team in rybnik running HFM for consolidation reporting should treat this as a priority fix, since financial data exfiltration carries regulatory, audit, and legal implications that dwarf the raw CVSS score. The low attack complexity (AC:L) means exploitation is straightforward and automatable once a valid low-privileged credential is obtained, making insider threat and credential-stuffing scenarios realistic vectors.

An attacker holding a low-privileged Oracle Hyperion Financial Management account - such as a read-only analyst account or a compromised service account - sends crafted HTTP requests targeting the Security component, bypassing the authorization layer to access financial reports, entity consolidation data, or other records outside their permitted scope. No public exploit code has been identified at time of analysis, but the low attack complexity means the technique could be developed and scripted quickly by a motivated insider or attacker who has obtained valid credentials through phishing or credential stuffing.