Oracle Hyperion Financial Management CVE-2026-70944

The attacker must have low-level authenticated network access to the Oracle Hyperion Financial Management instance over TCP - meaning a valid low-privileged account on the system or application is required, consistent with PR:L in the CVSS vector. No user interaction from a victim is needed. The vulnerability is in the Security component, so HFM must be network-accessible (not firewalled off from the attacker's position). There is no indication of a non-default configuration requirement from the available data. Exploitation is limited by the need for at least minimal authentication; fully unauthenticated external exploitation is not supported by the PR:L vector. Organizations that restrict HFM access to internal networks reduce exposure but do not eliminate risk from insiders or compromised internal accounts.

The CVSS 3.1 base score of 8.8 is well-supported by the vector: network-accessible, low attack complexity, low privileges required, no user interaction, and full C/I/A impact. This places it in the high-severity tier with realistic exploitability. No EPSS score was provided in the input, and no KEV listing or public POC has been identified, so exploitation status is unconfirmed from authoritative sources. The combination of low complexity and low privilege requirement is the most significant risk amplifier - any authenticated user (including low-privileged service or application accounts) could potentially escalate to full system control. HFM deployments are common in large enterprises and public-sector finance teams, and the Oracle August 2026 CPU release cadence means organizations that lag on patch cycles are exposed. The absence of a CWE designation leaves root cause uncertain, which complicates compensating control design. Overall, this should be treated as a high-priority patch for any organization running HFM 11.2.25.0.000 with network-exposed instances.

An attacker with a low-privileged account on an enterprise network - such as a compromised service account or a malicious insider - sends a crafted TCP request to Oracle HFM's exposed Security component endpoint. The request triggers the vulnerability, yielding full control over the HFM application, including access to sensitive financial consolidation data and the ability to modify or destroy records. No public exploit code has been identified, but the low attack complexity suggests the technique could be developed by a motivated adversary with knowledge of HFM internals.