Hyperion Financial Management EUVD-2026-61779

Exploitation requires a valid authenticated session on Oracle Hyperion Financial Management 11.2.25.0.000 with at minimum low-level privileges (PR:L per the CVSS vector) - unauthenticated external attackers cannot directly exploit this vulnerability. The attacker must have network access to the HFM application via HTTP, consistent with a standard web-accessible or internally reachable deployment. The vulnerability is specific to the Security component of version 11.2.25.0.000; other versions are not confirmed affected. No non-default feature enablement or special configuration mode is mentioned as a prerequisite in the description. Limiting factors include the authentication requirement (even a low-privileged account must exist and be accessible to the attacker) and the specific version constraint; organizations on other HFM versions or those with strict network segmentation limiting HTTP access to HFM servers face reduced exposure.

The CVSS 3.1 base score of 7.7 is driven primarily by the network attack vector, low complexity, scope change, and high confidentiality impact, all of which are well-supported by the vulnerability description. The PR:L metric confirms that exploitation requires at least one valid low-privileged credential, which meaningfully narrows the attacker pool compared to a pre-authentication flaw, but this is a realistic threshold in enterprise environments where contractor accounts, read-only reporting users, or compromised credentials are common. No EPSS score was provided in the source data, and the vulnerability does not appear in the CISA KEV catalog, so active exploitation has not been confirmed; however, the absence of KEV listing does not equate to low interest, and even a mid-sized municipal IT team in kielce running Oracle Hyperion for statutory financial reporting should treat this as an urgent patching priority given the financial data sensitivity. The Authentication Bypass tag suggests this is a logic flaw in access control enforcement rather than a transport-layer issue, which would typically make it exploitable by scripted HTTP requests with low sophistication. The scope change elevates the real-world blast radius beyond what the 7.7 score alone might imply - data accessible to the broader Oracle Hyperion ecosystem could be exposed in a single attack. The lack of a CWE assignment and no independently confirmed POC are the two main unknowns that introduce uncertainty into the overall risk picture.

An attacker who holds a low-privileged Oracle Hyperion Financial Management account - such as a read-only reporting user or a compromised contractor credential - sends crafted HTTP requests to the Security component that trigger the access control bypass, elevating their read access to the full dataset accessible by the HFM application. Because attack complexity is low and no user interaction is required, the attacker can automate iterative data exfiltration of financial consolidation records, entity data, and intercompany transactions. The scope change in the CVSS vector suggests the attacker may also be able to reach data in other integrated Oracle Hyperion suite components through the same bypass.