Hyperion Financial Management CVE-2026-71150

Exploitation requires a valid low-privilege user account within Oracle Hyperion Financial Management - the CVSS PR:L metric confirms that unauthenticated exploitation is not possible. The target instance must be running version 11.2.25.0.000 and must be reachable over HTTP from the attacker's network position. No user interaction from a higher-privileged user is required (UI:N), and attack complexity is rated low (AC:L), meaning no race conditions, special timing, or non-default environmental configurations are necessary beyond credential possession. The limiting factors for exploitation are: (1) the attacker must hold or have obtained a valid application account at any privilege level, and (2) the target version must specifically be 11.2.25.0.000. The vulnerability is scoped to the Security component, suggesting the exploit path runs through authentication or authorization processing rather than application business logic.

The CVSS 8.8 score is well-supported by its vector: network-accessible over HTTP, low attack complexity, low-privilege required, no user interaction, and full C/I/A impact make this a realistic and serious threat in any environment running version 11.2.25.0.000. No EPSS score was provided in the available data, which limits probabilistic exploitation modeling. Neither a CISA KEV listing nor public exploit code has been identified at time of analysis, meaning active exploitation is not confirmed - however, the bar to exploitation is low enough that even a mid-sized municipal IT team in walbrzych responsible for Oracle Hyperion financial consolidation should treat this as urgent and patch ahead of their standard change window. A notable inconsistency exists between the EUVD tag 'Information Disclosure' and Oracle's own stated impact of full system takeover including integrity and availability - the tag materially understates the risk. The primary real-world limiting factor is the PR:L requirement: attackers must already possess a valid, low-privilege application account, which narrows the threat actor pool to insiders or those who have previously compromised credentials.

An attacker holding a low-privilege account on an exposed Oracle Hyperion Financial Management 11.2.25.0.000 instance crafts and sends a malicious HTTP request targeting the Security component. The flaw - likely an authorization bypass or privilege escalation within the security subsystem - allows the attacker to elevate their access to administrative level, achieving full control over the application, its financial data, and underlying system availability. No public exploit code has been identified, but the low complexity rating indicates the attack does not require advanced techniques.