Hyperion Financial Management CVE-2026-71090

Exploitation requires a valid low-privileged authenticated account within Oracle Hyperion Financial Management version 11.2.25.0.000 and HTTP network access to the Security component. The CVSS AC:H metric confirms that additional preconditions beyond credentials and network reachability must be satisfied - such as a race condition, timing window, or specific internal system state - making exploitation non-trivial and not automatable via simple scanning. Exploitation scope is bounded to the single affected instance (S:U), meaning no inherent cross-system lateral movement is part of this vulnerability's impact surface. The CVSS PR:L metric confirms that unauthenticated external attackers cannot directly exploit this vulnerability; a valid account on the Hyperion system is a hard prerequisite. No special non-default configuration flag or feature enablement is described in available advisory data as an additional requirement.

The CVSS 3.1 base score of 6.4 (Medium) reflects a genuine mixture of notable availability impact (A:H, enabling complete and repeatable denial of service) constrained by high attack complexity (AC:H) and a low-privilege prerequisite (PR:L). The AC:H metric is operationally significant: it implies the attacker must satisfy conditions beyond a simple authenticated HTTP request - such as a timing dependency, race condition, or specific system state - making automated, mass-exploitation unlikely. No EPSS data was included in the available intelligence feeds, and the vulnerability is absent from the CISA KEV catalog, confirming no observed active exploitation at time of analysis. The partial confidentiality and integrity impacts (C:L/I:L) suggest bounded data exposure and modification risk rather than wholesale exfiltration or corruption. Despite the medium severity label, the A:H availability rating means that even a mid-sized municipal IT team in ustka relying on Hyperion for budget consolidation and financial close processing could face operational disruption if the service is crashed during a reporting cycle - making availability the most organizationally consequential impact dimension for this CVE. The combination of no KEV listing, no known public exploit, and high attack complexity positions this as a routine patch-cycle priority rather than an emergency response item, although organizations with internet-exposed Hyperion instances should elevate their urgency.

An attacker holding a valid low-privileged account on the Oracle Hyperion Financial Management instance sends specially crafted HTTP requests to the Security component under specific preconditions - such as a timing window or a particular system state satisfying the AC:H requirement - causing the application to hang or crash repeatedly. The same exploit interaction may simultaneously yield partial unauthorized reads of financial data subsets or limited unauthorized write access to certain records. No public exploit code exists at time of analysis, meaning exploitation currently requires independent vulnerability research and precise condition alignment.