Oracle Hyperion Financial Management CVE-2026-71120

Exploitation requires a low-privileged account on Oracle Hyperion Financial Management (PR:L), network access to the application via HTTP, and the ability to meet high-complexity conditions (AC:H) - likely a specific request sequence, session state, or timing window targeting the Security component. The vulnerability is limited to version 11.2.25.0.000 of Oracle Hyperion Financial Management. Exploitation is bounded by the need for valid credentials at any privilege level; unauthenticated external attackers cannot trigger this vulnerability. The AC:H rating is the primary limiting factor for reliability of exploitation, as it implies the attacker cannot simply fire arbitrary requests but must satisfy an unstated environmental or temporal precondition. Impact is confined to availability - no confidentiality or integrity compromise is possible through this path.

The CVSS 5.3 Medium score reflects the high complexity penalty applied to a network-reachable denial-of-service affecting a specialized enterprise product. AC:H indicates exploitation is not straightforward - timing dependencies, specific session states, or environmental prerequisites are likely required, which meaningfully limits opportunistic exploitation. PR:L confirms a low-privileged authenticated account is necessary, further narrowing the attacker pool to insiders, compromised service accounts, or those who have already obtained initial access. No EPSS data was supplied, and the absence from CISA KEV and lack of reported POC code all point to a low near-term exploitation likelihood. That said, even a mid-sized municipal finance department in kalisz running HFM 11.2.25.0.000 should factor in that a targeted denial-of-service against a financial consolidation platform during a close or audit period carries operational consequences well beyond what the numeric score conveys. The availability-only impact (C:N/I:N/A:H) means no data exfiltration risk exists, but repeated crashes of the financial management application during reporting cycles could cause significant business disruption. Overall: low automated exploitation risk, moderate targeted disruption risk for organizations dependent on HFM availability.

An attacker with a low-privileged HFM account - such as a read-only reporting user or a compromised service account - crafts HTTP requests targeting the Security component under specific conditions (such as timing or session state) required by the AC:H rating. Repeated delivery of these requests causes the application to hang or crash, rendering HFM unavailable to all users during a financial reporting or audit period. No public exploit code exists at time of analysis, meaning this scenario currently requires attacker knowledge of the specific triggering conditions.