Oracle Hyperion Financial Management CVE-2026-71123

Exploitation requires network access to Oracle Hyperion Financial Management's HTTP interface and human interaction from a person other than the attacker - specifically, a user (likely an authenticated HFM user) must interact with a crafted request or link delivered by the attacker. The CVSS vector (PR:N) confirms no attacker authentication is required, but the UI:R metric is a hard prerequisite: attacks cannot succeed without victim interaction. The vulnerability is in the Security component, tagged Authentication Bypass, implying the bypass is triggered through the HTTP request itself rather than requiring server-side configuration changes. Exploitation is bounded to partial data read and write on HFM-accessible data; there is no code execution or availability impact. Deployments where HFM is not externally reachable and users do not interact with external links are at materially lower risk.

The CVSS 3.1 base score of 5.4 (Medium) reflects limited blast radius: confidentiality and integrity impacts are partial (C:L, I:L) with no availability impact (A:N), and scope is unchanged (S:U). The UI:R requirement is a meaningful real-world mitigating factor - exploitation is not fire-and-forget; an attacker must socially engineer or phish a target user. However, AC:L and PR:N indicate the attack itself requires no special conditions or credentials, reducing attacker skill requirements significantly. No EPSS score was provided in input data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no POC has been identified, suggesting opportunistic mass exploitation is not currently occurring. Oracle's designation of this as 'Easily exploitable' in the advisory language elevates concern despite the medium CVSS score. Real-world risk is moderate for organizations running HFM externally or without network segmentation; internally-only deployments with no internet-facing exposure face reduced risk due to the UI:R constraint requiring a reachable victim.

An attacker identifies an organization running Oracle Hyperion Financial Management 11.2.25.0.000 accessible via HTTP and crafts a malicious URL or embedded request exploiting the Security component authentication bypass. The attacker delivers this payload to a financial analyst or HFM user via phishing email or a compromised internal page; when the victim interacts with the payload in their authenticated browser session, the bypass is triggered, allowing the attacker to read a subset of financial data and perform unauthorized inserts or modifications to accessible records. No public exploit code has been identified, but Oracle's own advisory characterizes this as 'Easily exploitable,' indicating low technical barrier once a victim is engaged.