Oracle Hyperion Financial Management CVE-2026-71091

Exploitation requires high-privileged authenticated access to Oracle Hyperion Financial Management 11.2.25.0.000 over the network via SQL, as indicated by the CVSS vector (AV:N/AC:L/PR:H). The attack complexity is low ('easily exploitable' per Oracle's description), meaning no special timing, race conditions, or advanced techniques are needed once credentials are available. The 'Authentication Bypass' tag in the source intelligence may indicate that the exploit circumvents secondary authorization checks within an already-authenticated privileged session rather than bypassing the initial login - this distinction is not confirmed by available data and should be treated as an open question until verified against the Oracle CPU documentation. Exploitation is limited to attackers who control or have compromised a high-privileged HFM account; unauthenticated or low-privileged exploitation is not supported by the CVSS vector. There is no user interaction required once access is established.

The provided CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). The PR:H metric is the primary risk limiter here - exploitation requires an attacker who already holds high-privileged credentials to the application, reducing the realistic attack population significantly. However, the 'Authentication Bypass' tag reported alongside this CVE introduces a notable contradiction: if the vulnerability truly allows bypassing authentication or authorization controls, PR may be effectively lower in practice than the CVSS vector reflects. This discrepancy is not resolved in the available data and should be verified with the Oracle CPU advisory. No EPSS score is available in the provided data. The vulnerability is not in the CISA KEV catalog, and no public proof-of-concept exploit has been identified at time of analysis. Despite the high C:H and I:H impact metrics, the PR:H requirement and absence of Availability impact (A:N) place real-world exploitation risk below that implied by the individual impact metrics alone. The primary realistic threat is a malicious insider or a compromised admin account being used to exfiltrate or tamper with sensitive financial data.

An attacker with high-privileged credentials to Oracle Hyperion Financial Management - such as a finance system administrator or a threat actor who has compromised such an account - sends crafted SQL input via the network to the Security component. The crafted query bypasses or subverts the application's authorization enforcement, granting the attacker the ability to read all financial data (including data outside their authorized scope) and to create, modify, or delete critical financial records. No public exploit code is known to exist at time of analysis.