Hyperion Financial Management CVE-2026-71108

Exploitation requires the attacker to hold at least a low-privileged authenticated account within Oracle Hyperion Financial Management (PR:L per CVSS vector) and network reachability to the HFM HTTP interface (AV:N). The high attack complexity designation (AC:H) mandates an additional prerequisite beyond authentication - likely a specific application state, race condition, or particular configuration within the Security component - though the exact bypass condition is not disclosed in the available data. No user interaction is required (UI:N). Limiting factors include: the mandatory possession of valid credentials even at low privilege, the AC:H constraint that requires satisfying a specific but unspecified condition, and the HTTP-only attack path which requires network adjacency to the HFM server. The vulnerability is scoped to version 11.2.25.0.000 only; no other versions are confirmed affected. No specific OS platform or deployment topology is cited as a required condition beyond running the affected version.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) produces a moderate base score of 5.3, reflecting a network-exploitable flaw that nonetheless demands high attack complexity and at minimum a low-privilege credential. The AC:H constraint is operationally significant - it means opportunistic, automated scanning is unlikely to trigger the vulnerability without targeted knowledge of the bypass condition, and even a mid-sized municipal IT team in rybnik would see this as a lower-likelihood threat absent evidence of active targeting. The confidentiality-only impact (C:H, I:N, A:N) means no integrity or availability harm, but HFM environments typically hold highly sensitive financial consolidation data, so a C:H outcome carries substantial business and regulatory risk disproportionate to the raw CVSS score. No EPSS probability, CISA KEV status, or public proof-of-concept data were provided in the source intelligence, so exploitation probability in the wild is unknown and cannot be confirmed. Overall, this is a medium-priority finding: the AC:H and PR:L constraints limit realistic exposure, but the sensitivity of HFM data elevates business impact for organizations running this specific version.

A low-privileged HFM user with valid network credentials crafts a specific HTTP request targeting the Security component's authorization logic, satisfying the high-complexity precondition - such as a particular session state or timing window - and successfully bypassing access controls to read financial consolidation data belonging to other users or organizational units within the application. The AC:H rating indicates the attacker cannot trivially repeat this exploit on demand without first meeting an environment-specific prerequisite, distinguishing this from a straightforward credential-then-read attack. No public proof-of-concept has been identified, suggesting successful exploitation currently requires significant attacker familiarity with HFM internals.