Oracle Hyperion Financial Reporting EUVD-2026-61698

No special conditions are required for exploitation beyond network reachability: the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms this is a remote, unauthenticated attack against the default HTTPS-exposed Server component of Oracle Hyperion Financial Reporting 11.2.25.0.000. No specific non-default configuration, feature toggle, or privileged account is needed. The primary factor limiting exploitation is network exposure - organizations that have restricted access to the Hyperion Server to internal networks only will see significantly reduced real-world risk compared to those with internet-facing deployments. The vulnerability is version-specific to 11.2.25.0.000; organizations on earlier versions (which may also be vulnerable but are unsupported) or a patched version are not affected by this specific CVE.

The CVSS 3.1 base score of 8.2 is driven by AV:N/AC:L/PR:N/UI:N, indicating a trivially exploitable network-facing flaw requiring no authentication or user interaction - a profile associated with high exploitation likelihood in enterprise environments. The C:H metric signals complete read access to all data accessible by the Financial Reporting server, which in practice means sensitive financial records, management reports, and potentially consolidation inputs. The A:L metric reflects a partial DoS capability that could disrupt reporting workflows without fully taking the service down. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. KEV status is absent, and no public POC has been identified, suggesting no widespread active exploitation at time of analysis. However, the zero-barrier exploitation profile (unauthenticated, low complexity, network-reachable HTTPS) means that if a POC were published, mass scanning and exploitation would be expected rapidly. The financial sensitivity of data processed by Hyperion elevates business impact beyond what the partial-DoS A:L metric alone conveys. This should be treated as a high operational priority for affected organizations despite the absence of confirmed in-the-wild exploitation.

An unauthenticated attacker with HTTPS connectivity to the Oracle Hyperion Financial Reporting Server sends a crafted request to a vulnerable endpoint, bypassing authentication controls and obtaining full read access to all financial reports, consolidation data, and management information stored within the system. The same or a follow-on request could trigger a partial denial of service, temporarily disrupting reporting availability for legitimate users during a critical financial close period. No public POC exists at time of analysis, but the low attack complexity means exploitation requires only basic HTTP tooling.