Hyperion Financial Management CVE-2026-70940

The attacker must possess a valid low-privileged account with network access to the Oracle Hyperion Financial Management HTTP interface - the CVSS PR:L metric confirms that unauthenticated external attackers cannot exploit this without first obtaining credentials. The target must be running version 11.2.25.0.000 specifically. No user interaction beyond the attacker's own actions is required (UI:N). The specific configuration setting, feature flag, or deployment mode within the Security component that enables exploitation is not described in the available data. Exploitation is bounded by the credential requirement (PR:L): attackers without any account on the system are excluded, which limits opportunistic mass exploitation but does not prevent insider threats or attackers who have phished or stolen credentials.

The CVSS 8.8 score paired with AV:N/AC:L/PR:L/UI:N represents a highly dangerous combination: network-reachable, trivially exploitable once credentials are obtained, with no mitigating user interaction requirement. The S:U (unchanged scope) limits lateral blast radius per the CVSS model, but C:H/I:H/A:H indicates full takeover of the affected Financial Management instance itself - a system that typically hosts sensitive financial consolidation data. No EPSS score is available in the provided data, preventing probabilistic exploitation likelihood comparison. KEV status is absent and no POC is known, meaning real-world exploitation is not confirmed but cannot be ruled out. Attack complexity is low once low-level credentials exist, meaning even a mid-tier attacker capability profile is sufficient. The tags include 'Information Disclosure,' which appears to understate the vendor-described impact of full system takeover - this discrepancy should be noted: the CVSS vector and description both assert C:H/I:H/A:H (full compromise), not merely disclosure. The absence of a CWE classification is a data gap that prevents root-cause-based risk correlation.

An attacker holding any low-privileged account - such as a read-only financial analyst account or a service account - sends a crafted HTTP request to Oracle Hyperion Financial Management's Security component, triggering the vulnerability and achieving full system takeover including access to confidential financial consolidation data and the ability to corrupt or destroy records. No public proof-of-concept exploit is known at time of analysis, but the low attack complexity (AC:L) and absence of user interaction (UI:N) mean exploitation is straightforward for any attacker who understands the flaw.