Oracle Hyperion CVE-2026-70967

Exploitation requires an authenticated local OS logon session on the host where Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is installed and running - this is the primary limiting factor. The attacker must hold at minimum a low-privileged OS account (PR:L per CVSS vector); no Hyperion application account or elevated OS rights are required. The vulnerability is in the Installation and Configuration component specifically, implying the attack surface is accessible from the local system rather than over a network. No user interaction is required once local access is established. Remote network access alone is insufficient - an attacker must first obtain local system access via another vector (e.g., stolen credentials, lateral movement, or physical access). No specific non-default configuration setting is identified as required; the flaw appears to exist in the standard deployment of version 11.2.25.0.000.

The CVSS 3.1 base score of 7.1 reflects high confidentiality and integrity impact but is bounded by a local attack vector (AV:L) and low-privilege requirement (PR:L), meaning exploitation is not remotely possible without pre-existing foothold access. The 'easily exploitable' characterization from Oracle's own advisory is a significant signal - it implies low attack complexity post-access, not that the barrier to initial access is low. No EPSS score is available in the provided data, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation. The Authentication Bypass tag elevates concern for multi-tenant or shared-infrastructure deployments where multiple business users share the same OS-level host. The absence of availability impact (A:N) confirms this is a data exposure and tampering risk, not a disruption risk. Overall, real-world priority is moderate: high consequence if exploited on a shared host, but gated behind the requirement for an authenticated local OS session on the Hyperion server. Remote-only environments with strict server access control significantly reduce realistic exposure.

An attacker with a standard OS-level user account on the server running Oracle Hyperion Infrastructure Technology 11.2.25.0.000 - such as a developer, contractor, or compromised service account - exploits the authentication bypass in the Installation and Configuration component to elevate their effective access within the Hyperion application. They can then read all Hyperion-accessible data (financial plans, consolidation data, user credentials) or modify and delete critical records without holding explicit Hyperion administrative rights. No public proof-of-concept is currently known, but Oracle's characterization of the vulnerability as 'easily exploitable' suggests low technical skill is required once local access is obtained.