Oracle Hyperion CVE-2026-70957

Exploitation requires a low-privileged account with HTTP network access to Oracle Hyperion Infrastructure Technology version 11.2.25.0.000, as confirmed by CVSS PR:L and AV:N. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race conditions, special timing, or environmental prerequisites apply. The 'Authentication Bypass' tag suggests the vulnerability may allow a low-privileged attacker to escalate beyond their assigned authorization boundaries - if this tag is accurate, the effective privilege bar to achieve high-impact access may be lower than PR:L implies. Exploitation is limited to the confirmed affected version (11.2.25.0.000); other Hyperion versions are not listed. There is no indication of a non-default configuration requirement, suggesting standard Hyperion deployments accessible over HTTP are exposed. Availability impact is absent, meaning the attacker cannot use this vulnerability alone to cause a denial of service.

The CVSS 3.1 score of 8.1 with AV:N/AC:L/PR:L/UI:N is a strong real-world risk signal: the attack requires no special conditions, no user interaction, and only low-privilege network access via HTTP - Oracle itself describes it as 'easily exploitable.' Both confidentiality and integrity are fully compromised (C:H/I:H), covering unauthorized read and write access to all Hyperion-accessible data, including critical financial datasets. Availability is not impacted (A:N). No EPSS score is available in the provided data, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV, and no public POC has been identified, which moderates near-term threat actor exploitation urgency. However, the 'Authentication Bypass' tag introduces a notable caveat: if the PR:L designation reflects a bypass-able authentication gate rather than a truly required credential, the practical attack bar may be lower than the CVSS vector implies - this should be verified against the full Oracle CPU advisory. For organizations running Hyperion 11.2.25.0.000 in network-accessible deployments, this is a genuine priority warranting prompt patching.

An attacker who holds a low-privileged account within the Oracle Hyperion environment - or who obtains one through phishing or credential stuffing - sends crafted HTTP requests to the Installation and Configuration component of Hyperion Infrastructure Technology 11.2.25.0.000. The authentication bypass or authorization defect allows the attacker to exceed their granted permissions, resulting in unauthorized read access to all Hyperion-accessible data (financial records, planning models) and write access enabling creation, modification, or deletion of critical datasets. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means a working exploit would be straightforward to develop once the vulnerability mechanism is understood.