Hyperion Financial Management EUVD-2026-61793

Exploitation requires an authenticated OS-level session on the infrastructure host where Oracle Hyperion Financial Management 11.2.25.0.000 executes (AV:L); the attacker must hold at least a low-privileged account with logon rights to that specific host (PR:L). No user interaction from a victim is required (UI:N), and attack complexity is low (AC:L), meaning no race condition or special timing is involved. No special non-default configuration beyond standard HFM deployment on the affected version is specified in available data. The primary factor limiting exploitation is the local vector: remote-only attackers without OS-level host logon access cannot exploit this vulnerability directly. The scope-change impact on co-hosted Oracle products only materializes when additional Oracle Hyperion components share the same host or storage resources as the vulnerable HFM instance.

The CVSS 8.4 High score is driven by the low-complexity, low-privilege local exploit path combined with a scope change that extends confidentiality and integrity impacts to adjacent Oracle products. The local attack vector (AV:L) narrows the threat surface to users or processes with existing OS-level logon access to the HFM host, which is a meaningful constraint in environments with strict host access controls. However, the 'Authentication Bypass' tag and the Security component location suggest the flaw may allow a low-privileged domain or application user to escalate permissions far beyond their intended role, making insider threat and compromised-credential scenarios the most credible attack paths. No EPSS data was provided and the vulnerability is absent from CISA KEV, indicating no confirmed widespread exploitation at this time - but the absence of data should not be read as absence of risk: even a mid-sized municipal finance team in gniezno running Hyperion on shared on-premises infrastructure should treat this as a high-priority remediation given the scope change's potential to compromise co-hosted Oracle suite components. The missing CWE and the lack of a vendor-confirmed post-patch version number reduce confidence in precise root-cause and fix scope.

An attacker holding a low-privileged domain or application account with logon rights to the Oracle Hyperion Financial Management host authenticates to the server and exploits the authentication bypass flaw in the Security component. Without requiring elevated privileges or any victim interaction, the attacker gains unauthorized read access to all HFM financial consolidation data and write or delete capability over critical records, then leverages the scope change to access or tamper with data in co-hosted Oracle Hyperion suite products. No public proof-of-concept code has been identified at time of analysis.