Oracle Hyperion CVE-2026-70973

The attacker must possess at minimum low-level authenticated access to the Oracle Hyperion environment (CVSS PR:L) - unauthenticated exploitation is not possible based on the provided CVSS vector. Network access to the target over HTTP is required (AV:N). The high attack complexity (AC:H) indicates a specific, non-trivial condition must be met - Oracle's advisory does not disclose what that condition is, but it may involve a race condition, a particular system state during installation or configuration operations, or a dependency on specific environmental factors. Exploitation is further limited to the single confirmed version 11.2.25.0.000; other versions are not confirmed affected. The lack of a CWE and the vague component description ('Installation and Configuration') mean the exact triggering configuration or feature is unknown from public data. These combined prerequisites - authenticated access plus high complexity - substantially narrow the realistic attacker population.

The CVSS 3.1 base score of 7.5 reflects a meaningful but moderated risk profile: AV:N indicates full network accessibility over HTTP, PR:L requires the attacker to hold at least some authenticated foothold, and AC:H materially reduces exploitability by demanding complex conditions not easily reproduced at scale. The combined outcome - full CIA takeover - is the most severe possible, which elevates urgency despite the high-complexity barrier. No EPSS score is available, making probabilistic exploitation likelihood comparison with the broader CVE corpus impossible. The vulnerability does not appear in CISA KEV, and no public proof-of-concept exploit has been identified, so there is no current evidence of opportunistic or widespread exploitation. The 'Information Disclosure' tag is inconsistent with the full-triad CVSS impact; this may reflect an initial triage tag that predates full vendor scoring, or that information disclosure is one pathway toward the broader takeover - the discrepancy cannot be resolved from available data. Overall, this is a high-severity, low-immediacy risk: patch urgently in exposed environments but the AC:H and PR:L prerequisites reduce realistic attack surface compared to simpler network-exploitable CVEs.

An attacker who has obtained low-privilege credentials to the Oracle Hyperion environment - through credential theft, phishing, or insider access - sends a specially crafted HTTP request to the Installation and Configuration component, satisfying the high-complexity preconditions such as a specific system state or timing window. If the complex conditions are met, the attacker achieves full control over the Hyperion Infrastructure Technology instance, enabling exfiltration of financial planning data, modification of configuration, or service disruption. No public proof-of-concept exists, meaning exploitation likely requires significant attacker capability or prior knowledge of the specific complex conditions.