Oracle Hyperion PCM EUVD-2026-61678

The attacker must possess a valid low-privilege account with network access to the Oracle Hyperion PCM Deployment component over HTTP - the CVSS PR:L metric confirms some authentication is required. The target system must be running Oracle Hyperion Profitability and Cost Management version 11.2.25.0.000 specifically. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race conditions or special configuration states are needed beyond a reachable Deployment endpoint. The Authentication Bypass tag from ENISA EUVD suggests the privilege requirement may effectively be circumventable - defenders should not assume that absence of admin credentials prevents exploitation. Exploitation is limited to environments where the Deployment component is network-accessible and the specific affected version is deployed; organizations on earlier or later PCM versions are not confirmed affected. Integrity and availability are not impacted, bounding the blast radius to data disclosure.

CVSS 3.1 base score of 7.7 (High) is driven entirely by a confidentiality impact (C:H) with scope change (S:C), while integrity and availability are unaffected (I:N, A:N). The attack vector is network (AV:N) with low complexity (AC:L), no user interaction (UI:N), and low privilege required (PR:L). This profile indicates a straightforward, repeatable exploit path requiring only a valid low-privilege account. The Authentication Bypass tag from ENISA EUVD introduces a potential discrepancy: a true authentication bypass would suggest PR:N is more accurate than the official PR:L - defenders should verify whether any authenticated session suffices or if pre-authentication exploitation is possible. EPSS data is not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public POC are confirmed, indicating this is not currently under widespread active exploitation. However, Oracle Hyperion environments frequently hold sensitive financial modeling and cost data, making this a high-value target for espionage or competitive intelligence actors despite the lower deployment footprint. The scope change is a meaningful risk multiplier in shared EPM environments.

An attacker with a valid low-privilege Oracle Hyperion account - such as a standard analyst or read-only reporting user - sends a crafted HTTP request to the PCM Deployment component, bypassing authorization checks that should restrict access to sensitive configuration or data artifacts. The attacker retrieves complete data accessible to the PCM application, potentially including financial models, cost allocation data, and configuration details from interconnected Hyperion products sharing the same EPM infrastructure. No POC is confirmed, but the low attack complexity (AC:L) and no user interaction required (UI:N) indicate the exploit path is straightforward once the authorization bypass mechanism is understood.