Hyperion Financial Management CVE-2026-71148

Exploitation requires network-level HTTP access to an Oracle Hyperion Financial Management 11.2.25.0.000 instance - specifically to the Security component's HTTP endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, user interaction, or special configuration state is needed; the vulnerability is exploitable against default deployments wherever the HFM HTTP interface is reachable. Exploitation is limited to read access of a subset of data only - no write, delete, or availability impact is possible through this vector. The primary limiting factor is network exposure: organizations that have HFM deployed behind internal firewalls with no internet-facing access significantly reduce realistic exploitation risk, as attackers must first obtain internal network access.

The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) places this in the Medium range, reflecting a real but bounded risk - unauthenticated network access with limited read-only impact and no integrity or availability consequence. The 'Authentication Bypass' tag elevates practical concern beyond the numeric score alone, since HFM instances routinely hold sensitive financial consolidation data that organizations treat as highly confidential, meaning that even a mid-sized municipal IT team in swidnica should treat patching this as a priority if HFM is internet-reachable. No EPSS score is available in the provided intelligence, making probabilistic exploitation likelihood difficult to quantify independently. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept code has been identified, suggesting exploitation has not yet become widespread or automated. The primary real-world risk is targeted financial data reconnaissance against organizations with HFM exposed to untrusted networks - the low attack complexity means exploitation requires no specialized tooling, only HTTP access.

An unauthenticated attacker with network access to the Oracle Hyperion Financial Management HTTP interface sends a crafted request to the Security component endpoint, which fails to validate authentication state before returning data. The server responds with a subset of financial or organizational data accessible through that endpoint - potentially including entity structures, report metadata, or user-accessible records - without requiring any credentials. No public exploit code has been identified, but the low complexity means standard HTTP tooling is sufficient for exploitation.