Hyperion Financial Management CVE-2026-71103

Requires a valid low-privileged Oracle Hyperion Financial Management user account (PR:L per vendor-confirmed CVSS vector); unauthenticated attackers cannot exploit this vulnerability directly. Network access to the HFM application via HTTP is required (AV:N). No user interaction beyond the attacker's own session is needed (UI:N). The affected version must be 11.2.25.0.000. No special non-default configuration is indicated - the vulnerability exists in the base Security component as shipped. Scope is unchanged (S:U), meaning successful exploitation does not break out to affect other systems. Exploitation is limited by the credential requirement: the primary threat actors are malicious insiders, compromised accounts, or attackers who have already obtained valid credentials via phishing or credential stuffing.

The CVSS 3.1 score of 6.3 (Medium) is assessed as a credible reflection of real-world risk for this vulnerability. The PR:L requirement is the key limiting factor - exploitation is gated on possession of a valid HFM user account, which substantially reduces the attack surface relative to unauthenticated flaws. The network attack vector (AV:N) and low complexity (AC:L) mean that any user with credentials and HTTP reachability to the application can exploit this without special conditions. No EPSS score is available from the provided data, so exploitation probability cannot be quantified. No CISA KEV listing and no public POC exist at time of analysis, suggesting this has not been weaponized in the wild. The combined impact is partial across all three CIA dimensions - meaningful in a financial application context where data integrity and confidentiality are regulated concerns, but not a full system compromise. Overall: a genuine medium-priority issue for organizations running the affected version, especially those with broad internal user bases or internet-exposed HFM deployments.

An attacker with a valid low-privileged HFM user account - such as a read-only financial analyst - sends crafted HTTP requests to the Oracle Hyperion Financial Management Security component. By exploiting the authorization weakness, the attacker reads financial data beyond their permitted scope, inserts or modifies accessible records, and intermittently disrupts service availability for other users. No public proof-of-concept code is known at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward once credentials are obtained.