Oracle Hyperion Financial Management CVE-2026-70939

Exploitation requires possession of a high-privileged Oracle Hyperion Financial Management account (reflected by PR:H in the CVSS vector) - unauthenticated exploitation is not possible. The attacker must have network access to the HFM instance via HTTP, meaning the application's web interface must be reachable from the attacker's position. The affected version is specifically 11.2.25.0.000; other versions are not confirmed affected. No user interaction is required once credentials are obtained. The unchanged scope (S:U) means exploitation is bounded to the HFM system and does not inherently chain to adjacent systems. Exploitation is limited by: the requirement for high-privilege credentials (insider or post-compromise scenario), network reachability of the HTTP interface (mitigable via firewall segmentation), and the specific version requirement. No special non-default configuration is described as a prerequisite beyond a deployed and network-accessible instance of the affected version.

The CVSS 3.1 score of 7.2 (High) reflects full system takeover potential (C:H/I:H/A:H), which in the context of a financial consolidation platform represents significant business risk including data exfiltration of sensitive financial records, data manipulation, and service disruption. However, the PR:H requirement is a meaningful gating factor - exploitation is contingent on the attacker already possessing or having compromised a high-privileged HFM account, which substantially narrows the realistic threat surface compared to an unauthenticated flaw. No EPSS probability data is available for comparison, and the absence from CISA KEV indicates no confirmed active exploitation at time of analysis. No POC code has been identified. The low attack complexity (AC:L) means that once credentials are obtained, the exploit path is not technically demanding, elevating risk in insider-threat, credential-stuffing, or post-compromise scenarios. The unchanged scope (S:U) limits blast radius to the HFM system itself. Overall, this is a genuine high-severity vulnerability for organizations running the affected version, but it is access-gated rather than immediately exploitable without prior foothold.

An attacker who has compromised or fraudulently obtained credentials for a high-privileged Oracle Hyperion Financial Management account sends a specially crafted HTTP request targeting the Security component of a network-accessible HFM 11.2.25.0.000 instance. Leveraging the low-complexity flaw, the attacker escalates their access to achieve full system takeover, enabling exfiltration of sensitive financial consolidation data, manipulation of reported figures, or denial of service to the financial close process. No public exploit code has been identified at time of analysis, making this scenario most realistic in insider-threat or post-credential-compromise attack chains.