Oracle Hyperion Financial Management CVE-2026-71118

Exploitation requires unauthenticated network access to the Oracle Hyperion Financial Management HTTP interface (AV:N, PR:N per CVSS vector). The high attack complexity (AC:H) indicates that specific, non-trivially satisfied conditions must exist - the description does not enumerate these precisely, but AC:H in Oracle CPU advisories typically denotes requirements such as a specific application state, race condition, or prerequisite interaction that the attacker does not fully control. No user interaction is required (UI:N). Exploitation is limited to version 11.2.25.0.000 specifically; deployments on earlier or later versions are not confirmed as affected. Impact is bounded to subsets of data accessible through the application - full database or operating system compromise is not within scope of this vulnerability. The absence of an assigned CWE means the precise configuration or feature dependency cannot be confirmed from available data.

The CVSS 3.1 base score of 4.8 (Medium) reflects genuine moderate risk bounded by meaningful mitigating factors. The network attack vector (AV:N) and lack of required authentication (PR:N) represent real exposure for internet- or intranet-facing deployments, but the high attack complexity (AC:H) substantially reduces the probability of casual or automated exploitation - meaning an attacker must overcome specific preconditions (likely timing, environmental state, or prior reconnaissance). Impact is limited to partial confidentiality and integrity (C:L/I:L) with no availability impact, confining the blast radius to subsets of accessible financial data rather than full system compromise or data destruction. No EPSS data was supplied, so exploitation probability cannot be quantified independently; however, the combination of AC:H, a niche enterprise product, and no observed KEV or POC suggests a low real-world exploitation rate. Even a mid-sized financial services organization in kielce would reasonably treat this as a scheduled-patching priority rather than an emergency out-of-band response, given the absence of active exploitation signals. The missing CWE classification is a data gap - without it, root-cause-based compensating controls cannot be precisely targeted.

An unauthenticated attacker with HTTP network access to an Oracle Hyperion Financial Management 11.2.25.0.000 deployment identifies and satisfies the specific high-complexity preconditions required to bypass the Security component's authentication controls - likely involving a particular application state, request sequence, or timing window. Upon successful bypass, the attacker reads a subset of sensitive financial consolidation data or injects limited unauthorized modifications to financial records accessible through the application. No public exploit code has been identified, meaning this scenario currently requires attacker-developed tooling and knowledge of the specific exploitation conditions.