Oracle Hyperion Financial Management CVE-2026-70952

No special conditions are required for exploitation. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against the default network-accessible HTTP interface of Oracle Hyperion Financial Management 11.2.25.0.000. The sole limiting factors are: (1) the target must be running the specific affected version 11.2.25.0.000, and (2) the HFM HTTP interface must be reachable by the attacker - deployments behind strict network perimeter controls with no external HTTP exposure have a meaningfully reduced attack surface. No non-default configuration, authenticated session, or user interaction is required to trigger the vulnerability.

The CVSS 3.1 base score of 8.2 is well-supported by the vector: network attack surface, low complexity, no privileges, no user interaction, and high confidentiality impact. The absence of an integrity impact metric (I:N) suggests the flaw allows read-only unauthorized access plus a partial availability disruption rather than data manipulation. No EPSS score was provided, which limits probabilistic exploitation forecasting. There is no CISA KEV listing and no known public proof-of-concept at time of analysis, so real-world exploitation risk is plausible but not confirmed. The affected product is an on-premises enterprise financial platform with a narrow deployment universe; however, given that it handles sensitive financial consolidation data, even a mid-sized corporate finance team in koszalin operating this specific build should treat this as urgent given the complete data-exposure potential. The combination of zero-prerequisite network exploitation and high-value financial data makes the business impact disproportionate to the relatively narrow install base.

An external attacker with HTTP access to the Oracle Hyperion Financial Management server sends a crafted unauthenticated HTTP request targeting the Security component. With no credentials, no special configuration, and no victim interaction required, the attacker retrieves all financial data accessible to the application - including consolidation reports, entity hierarchies, and potentially regulated financial statements - and may intermittently disrupt service availability. No public exploit code has been identified at time of analysis, but the low attack complexity makes independent exploit development straightforward.