Hyperion Financial Management CVE-2026-70960

Exploitation requires the attacker to hold a valid low-privileged account within Oracle Hyperion Financial Management, confirmed by CVSS PR:L - unauthenticated external attackers cannot directly trigger this flaw. Additionally, successful exploitation requires human interaction from a person other than the attacker, per both the CVSS UI:R metric and the explicit CVE description; the attacker cannot autonomously exploit the vulnerability without victim participation such as clicking a crafted link or loading a malicious resource. The application must be reachable over HTTP from the attacker's network position (AV:N). No non-default configuration or special feature enablement is described as a prerequisite - any standard deployment of Hyperion Financial Management 11.2.25.0.000 accessible over the network with active low-privileged user accounts appears to fall within scope. Exploitation is meaningfully limited by the combination of required authentication and required victim interaction, which prevents fully automated scanning-style attacks.

The CVSS 7.6 score (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) reflects a real but conditionally bounded risk: the attack is network-accessible with low complexity but requires both a valid low-privilege account and human interaction from a victim, which significantly reduces the likelihood of automated or opportunistic mass exploitation. The scope change (S:C) is the most consequential signal - a successful compromise can cascade to additional Oracle Hyperion products within the same environment, amplifying the effective blast radius beyond the directly vulnerable component. No EPSS data was provided and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis; even a mid-sized municipal finance department in ustka running Hyperion for statutory consolidation should treat this as a scheduled patch-cycle priority rather than an emergency incident, targeting the Oracle August 2026 CPU within their standard remediation window. That said, the high confidentiality impact on a platform handling sensitive financial consolidation data, combined with the scope change, elevates this above routine maintenance priority in regulated or audited environments.

An attacker holding a valid low-privileged HFM account crafts a malicious HTTP request targeting the Security component, then induces a victim user to interact with it - for example, through a phishing link or embedded resource in an internal communication. Upon the victim's interaction, the Security component authorization flaw triggers, granting the attacker complete read access to all HFM financial consolidation data and limited write capability, with potential lateral impact to other connected Oracle Hyperion products in the same environment. No public proof-of-concept code has been identified at time of analysis.