Hyperion Financial Management EUVD-2026-61782

Requires a valid low-privileged account on Oracle Hyperion Financial Management 11.2.25.0.000 with HTTP network access to the application - confirmed by CVSS PR:L and AV:N metrics. The vulnerability is specifically in the Security component of HFM, meaning the application must be running and network-accessible. Attack complexity is low (AC:L), so no race conditions, timing dependencies, or special environmental configurations are needed beyond a valid credential. What limits exploitation: an attacker must possess or obtain a legitimate (even minimal) HFM account; fully unauthenticated exploitation is not supported by the PR:L metric. Scope is unchanged (S:U), meaning impact is confined to the HFM application itself and does not extend to the underlying OS or adjacent systems.

The NVD-assigned CVSS 3.1 score of 6.5 (Medium) is consistent with the vector metrics: network-accessible, low complexity, low privilege required, and high confidentiality impact with no integrity or availability impact. The PR:L metric is noteworthy - exploitation requires a valid low-privileged account, which meaningfully limits the attacker pool compared to a fully unauthenticated flaw. However, the 'Authentication Bypass' tag suggests that once inside, the attacker can read all data regardless of their assigned access tier, making credential theft or insider threat a realistic escalation path. No EPSS score was provided, limiting probabilistic exploitation assessment. No CISA KEV listing exists, and no POC has been identified, suggesting this is not currently being actively weaponized. For organizations running HFM for financial reporting, the confidentiality risk is significant given the sensitivity of financial consolidation data. The low attack complexity means exploitation requires no special conditions beyond a valid account, so organizations with broad user bases (e.g., large finance teams) should treat this as elevated priority.

An attacker who has obtained a low-privileged Oracle HFM account - through phishing, credential stuffing, or insider access - sends crafted HTTP requests to the Security component, bypassing authorization enforcement to retrieve financial consolidation data outside their assigned access scope. Because attack complexity is low and no user interaction is required, exploitation is straightforward once credentials are available and the application is reachable over the network. No public proof-of-concept has been identified, so exploitation currently requires independent discovery of the bypass mechanism.