Oracle Hyperion CVE-2026-70971

Exploitation requires possession of a valid low-privileged user account on the Oracle Hyperion Infrastructure Technology 11.2.25.0.000 instance (confirmed by PR:L in the CVSS vector), combined with HTTP network connectivity to the Installation and Configuration component. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) confirms that once authenticated, no additional user interaction, special attack complexity, or non-default configuration is required - the exploit path is straightforward from a valid session. The 'Authentication Bypass' tag suggests that authorization controls governing data scope are the bypassed mechanism, not the initial authentication gate. Primary limiting factors are: (1) valid credentials are mandatory - unauthenticated external attackers cannot exploit this directly; (2) the affected version is specifically 11.2.25.0.000, so upgraded instances are not confirmed vulnerable; (3) no scope change (S:U) means exploitation is bounded to the Hyperion system itself and does not inherently pivot to adjacent systems.

The vendor-assigned CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects a network-exploitable, low-complexity attack requiring only a low-privileged credential - a realistic bar for a threat actor who has compromised any standard user account in the environment. The high confidentiality impact is the dominant risk driver, indicating potential exposure of sensitive EPM data including financial plans, consolidation data, configuration secrets, or administrative settings. The limited integrity impact (I:L) suggests partial write access, which could enable configuration tampering. No EPSS score was provided in the available intelligence data, preventing probabilistic exploitation likelihood assessment. The vulnerability is not listed in CISA KEV, and no public proof-of-concept exploit code has been identified at time of analysis, moderating immediate risk. The 'Authentication Bypass' tag introduces an important nuance: if low-privilege credentials are sufficient to bypass authorization and reach critical-data endpoints, then any compromised standard user account becomes an escalation vector - widening the realistic attacker pool beyond dedicated administrators. Overall this is a genuine priority for Oracle Hyperion deployments rather than a high-CVSS-but-low-real-risk issue, primarily due to the credential-only barrier and high confidentiality impact.

An attacker who has compromised or legitimately possesses a low-privileged Oracle Hyperion user account sends crafted HTTP requests to the Installation and Configuration component, exploiting improper authorization controls to traverse beyond their assigned data scope. The attacker reads sensitive EPM configuration data, financial consolidation metadata, or administrative credentials accessible to higher-privileged roles, and performs limited insert, update, or delete operations on accessible records - potentially altering configuration state or injecting malicious entries. No public exploit code has been identified at time of analysis, so active exploitation would likely require custom tooling or familiarity with the Hyperion HTTP API surface.