Oracle Hyperion CVE-2026-70959

Exploitation requires a valid low-privileged authenticated account on Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (confirmed by PR:L in the CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H vector), combined with HTTP network access to the Installation and Configuration component. Oracle explicitly characterizes this as an 'easily exploitable' vulnerability, indicating no advanced exploitation techniques are required once access is obtained. What limits exploitation: unauthenticated attackers cannot exploit this without first compromising at least one low-privileged Hyperion account; only the specific supported version 11.2.25.0.000 is confirmed affected; the unchanged scope (S:U) means exploitation does not inherently pivot to other systems or infrastructure beyond the Hyperion platform; no user interaction is required from a victim, so social engineering is not part of the attack path.

The CVSS 3.1 base score of 8.1 reflects a High-severity finding with a network attack vector, low complexity, and dual High impacts on integrity and availability. The PR:L requirement is a meaningful real-world barrier: unauthenticated external attackers cannot exploit this directly without first obtaining at least low-privileged Hyperion credentials. No EPSS score was provided in available intelligence, and this CVE does not appear in the CISA KEV catalog, meaning no confirmed active exploitation has been recorded at time of analysis. No proof-of-concept exploit code has been publicly identified. The lack of a disclosed CWE limits confidence in understanding the precise exploit mechanism. Despite no confirmed exploitation, the operational impact for affected enterprises is significant: unauthorized deletion or modification of EPM financial data, or a crash of the Hyperion platform, could have serious business consequences during reporting cycles. Priority should be elevated for organizations running Hyperion 11.2.25.0.000 in internet-facing or broadly authenticated configurations.

An attacker who has obtained low-privileged Hyperion credentials-through phishing, credential stuffing, or internal access-sends crafted HTTP requests to the Installation and Configuration component, triggering unauthorized modification or deletion of critical Hyperion application data such as configuration parameters or financial application metadata. The attacker may additionally issue repeated malformed requests to cause a service hang or crash, disrupting all EPM users during a critical financial close cycle. No public proof-of-concept exploit exists at time of analysis, but Oracle's characterization of the vulnerability as 'easily exploitable' suggests minimal technical sophistication is required beyond authenticated access.