Hyperion Financial Management CVE-2026-70943

Exploitation requires the attacker to have network-level access to the physical or logical communication segment (LAN/VLAN) where Oracle Hyperion Financial Management 11.2.25.0.000 is deployed - confirmed by the CVSS AV:A (Adjacent Network) vector. No authentication credentials are required (PR:N) and no user interaction is needed (UI:N). The 'Security' component is the entry point, indicating HFM's authentication subsystem presents an interface accessible without credentials over the local network. The primary limiting factor is network adjacency: internet-based attackers cannot exploit this directly and must first pivot to an adjacent host. No non-default configuration or specific protocol enablement is described as a prerequisite - exploitation appears possible against standard HFM deployments on version 11.2.25.0.000 once adjacency is met. No platform-specific constraints beyond network position are identified in the available data.

The CVSS 3.1 score of 8.1 reflects a genuine High-severity vulnerability, with full confidentiality and integrity impact (C:H/I:H) and no authentication or interaction requirement. However, the AV:A (Adjacent Network) vector is a meaningful constraint: exploitation is not possible from the open internet without first pivoting through a host on the same network segment. For organizations with HFM deployed on a broad, flat corporate LAN - common in large enterprise environments - this constraint offers limited protection. No EPSS data was provided. No CISA KEV listing exists, and no public exploit code has been identified at time of analysis, so active exploitation is not confirmed. The AC:L rating indicates that once adjacency is achieved, exploitation requires no special conditions or brute-forcing, making it a reliable attack for any insider or network-adjacent threat actor. The absence of availability impact (A:N) limits the risk to data compromise rather than operational disruption, but for a financial reporting system, confidentiality and integrity violations carry significant business and regulatory consequences.

An attacker with access to the corporate LAN or VLAN hosting Oracle HFM - such as a malicious insider, a contractor, or an external attacker who has already compromised another host on that network segment - sends unauthenticated requests directly to HFM's Security component, bypassing authentication controls without providing credentials. The attacker then reads all financial consolidation data (including sensitive close-cycle reports and intercompany data) and modifies records to falsify financial reporting outputs. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means exploitation is mechanically straightforward once network adjacency is established.