Hyperion Financial Management CVE-2026-71149

Exploitation requires that the attacker already possesses a low-privilege account with the ability to log on interactively to the physical or virtual infrastructure host where Oracle Hyperion Financial Management 11.2.25.0.000 is installed (AV:L/PR:L). High attack complexity (AC:H) means specific conditions within the Security component must be met - precise conditions are not disclosed by Oracle, consistent with their standard advisory practice, but likely involve a timing window, specific HFM security configuration state, or particular file/object state. A second, separate human user (other than the attacker) must actively interact with the HFM system to trigger the vulnerability (UI:R). Exploitation is limited to the HFM application boundary (S:U) and produces only low-severity partial impact across CIA. Factors that limit exploitation: no remote or network-based attack path exists; unauthenticated or anonymous access is insufficient; the flaw cannot be triggered autonomously without the victim's interaction; high complexity reduces reliability and repeatability of exploitation.

The CVSS 3.1 base score of 4.2 (Medium) accurately reflects a constrained real-world risk profile. Four compounding factors suppress exploitability: the attack vector is strictly local (AV:L), complexity is high (AC:H, meaning specific preconditions must align), the attacker must already hold low-privilege credentials (PR:L), and a separate human actor must perform an action to trigger the flaw (UI:R). All three CIA impacts are rated Low, meaning successful exploitation yields only partial, bounded data access or a transient denial of service - not full system compromise. No EPSS data was included in the intelligence sources; KEV status is not listed, and no POC exists at time of analysis. This vulnerability is unlikely to be a near-term priority for most organizations unless threat actors with insider access to HFM infrastructure are a relevant concern. CVSS signals and description are internally consistent - no conflicting data noted.

A low-privileged user with an existing local session on the Windows Server host running Oracle Hyperion Financial Management 11.2.25.0.000 identifies the specific high-complexity precondition within the Security component, then waits for or socially engineers a second authenticated user to perform a triggering action (such as opening a specific HFM workflow or security object). Upon the victim's interaction, the attacker exploits the timing or permission flaw to read a subset of HFM financial data, modify records, or cause a transient service disruption. No public exploit code exists at time of analysis, making this scenario dependent on attacker-developed tooling and insider knowledge of HFM internals.