Oracle Hyperion Financial Management EUVD-2026-61798

Exploitation requires the attacker to hold a low-privilege local account (PR:L) on the specific host infrastructure where Oracle Hyperion Financial Management 11.2.25.0.000 executes - the CVSS AV:L vector confirms this is not remotely exploitable over a network without a prior local foothold. No user interaction is required once local access is established. The vulnerability is specific to version 11.2.25.0.000 of the Security component; other versions are not confirmed affected. Key factors limiting exploitation: (1) network-only attackers must first compromise a separate vulnerability to obtain local infrastructure access before this flaw becomes exploitable; (2) entirely unauthenticated exploitation is not possible - a valid low-privilege account on the HFM host is a hard prerequisite; (3) impact is bounded to data accessible by the HFM installation, though scope change extends this to adjacent Oracle suite products on the same infrastructure.

The CVSS 3.1 base score of 6.5 (Medium) is technically accurate but may understate operational risk in environments where HFM hosts sensitive financial consolidation data. The AV:L vector is the primary mitigating signal - this vulnerability cannot be exploited directly over a network, materially reducing the attack surface compared to a network-vector finding. However, PR:L means only a standard low-privilege local account is required, making insider threat and post-compromise lateral movement the realistic threat models. The S:C scope change elevates concern: a single HFM Security bypass can cascade to unauthorized access in adjacent Oracle products. Confidentiality impact is rated H, meaning full exposure of all HFM-accessible data - which in financial consolidation contexts typically includes multi-entity financial statements, intercompany transactions, and sensitive management reporting data. No EPSS score was available in the source data, and this CVE is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. The 'Authentication Bypass' tag paired with a PR:L requirement raises the question of whether a low-privilege user can fully impersonate higher-privilege roles within HFM - this mechanism is unconfirmed from available sources and should be verified with Oracle support.

An insider employee or an attacker who has established an initial foothold via an unrelated vulnerability and obtained a low-privilege OS account on the Oracle Hyperion Financial Management server exploits the Security component bypass to elevate their HFM data access rights and exfiltrate complete financial consolidation data - including multi-entity financials, intercompany eliminations, and management reports. Because the CVSS scope change is confirmed, the attacker may further pivot to access data in co-hosted Oracle Hyperion suite applications such as Planning or Essbase using the compromised context. No public exploit code has been identified at time of analysis.