Oracle Hyperion Financial Management EUVD-2026-61789

Exploitation requires the attacker to possess a valid low-privileged account with local logon access (interactive session or equivalent) to the operating system host on which Oracle Hyperion Financial Management 11.2.25.0.000 is installed and executing. The vulnerability resides specifically in the Security component, and once local access is obtained, no additional HFM administrative credentials or elevated OS privileges are required - the bypass occurs within HFM's own authorization layer. No user interaction from another party is required (UI:N), and no non-default configuration is stated as a prerequisite. Key limiting factors are: (1) the AV:L requirement - purely remote attackers without prior foothold on the HFM host cannot exploit this directly; (2) integrity impact is constrained to I:L, precluding full data destruction or unrestricted writes; and (3) no availability impact means the attacker cannot disrupt HFM service availability through this vulnerability alone.

The CVSS 3.1 score of 6.1 (Medium) accurately captures the constrained attack surface: exploitation requires an attacker to already hold a low-privileged OS-level logon on the HFM host (AV:L, PR:L), which substantially limits the attacker pool to insiders, service account holders, or attackers who have already achieved lateral movement. The high confidentiality impact (C:H) is the dominant risk signal - complete access to all HFM-accessible data, which for a financial consolidation platform typically includes intercompany transactions, consolidated financial statements, and regulatory reporting data. The limited integrity impact (I:L) means targeted data manipulation is possible but unrestricted write access is not. No EPSS score was included in source data, and the absence of a CISA KEV entry and any known POC suggest this is not currently being exploited opportunistically; however, even a mid-sized municipal IT team in gliwice operating HFM for public-sector financial close should treat this as a priority insider-threat vector, particularly in environments where HFM servers are accessible to a broad user population. The 'Authentication Bypass' tag elevates concern because it implies the Security component - not a peripheral feature - is the failure point, which could allow privilege escalation beyond the attacker's granted HFM role.

A low-privileged internal user - such as a finance application support operator, a developer with server access, or a shared-service account user - who already holds a valid OS logon to the HFM server authenticates locally and invokes the vulnerable Security component, bypassing HFM's internal access control checks to read financial consolidation data across all entities and business units beyond their granted scope. The low complexity means no specialized tooling beyond standard HFM client access or direct application interaction is required. No public POC has been identified at time of analysis.