Hyperion Financial Management CVE-2026-71145

Exploitation requires: (1) the attacker holds a valid low-privilege account with network access to HFM via HTTP (PR:L confirmed by CVSS); (2) a human victim other than the attacker must interact during the attack (UI:R), such as clicking a crafted link or visiting a malicious page in the context of the HFM application; (3) attack complexity is high (AC:H), meaning specific, non-default conditions must align - the exact configuration trigger is not disclosed in available data and should be confirmed via Oracle's advisory. Exploitation is limited by: mandatory user interaction from a separate party, required pre-existing low-privilege authentication, and high attack complexity constraining opportunistic automation. The scope change means successful exploitation can affect Oracle Hyperion ecosystem components beyond HFM itself.

The CVSS 3.1 base score of 4.4 (Medium) reflects several mitigating factors: high attack complexity (AC:H), required user interaction (UI:R), and limited impact (C:L/I:L/A:N). Despite the scope change (S:C), the overall risk is moderate. No EPSS score was provided, so exploitation probability cannot be quantified from probabilistic models. The vulnerability is not listed in CISA KEV, and no public exploit or POC has been identified. The 'Authentication Bypass' tag is notable: if accurate, it suggests a potentially more impactful underlying flaw than the CVSS score alone conveys - however, PR:L indicates some level of prior authentication is required, which conflicts with a full bypass scenario. This discrepancy should be verified with Oracle's advisory. In practice, this vulnerability is most dangerous in environments where multiple Oracle Hyperion products are integrated, given the scope change. Defenders in financial services deploying HFM 11.2.25.0.000 should treat this as a real patching priority given the sensitivity of financial data, even though broad opportunistic exploitation is unlikely due to AC:H and UI:R constraints.

A low-privileged attacker with authenticated HTTP access to the HFM environment crafts a request targeting the Security component under specific, complex conditions, then social-engineers or waits for a legitimate user to interact with a malicious link or page. Upon victim interaction, the Security component's authorization logic is bypassed or improperly evaluated, granting the attacker unauthorized read access to financial data and the ability to insert or modify records within HFM, with potential spillover into connected Oracle Hyperion components. No public exploit code has been identified at time of analysis.