Hyperion Financial Management EUVD-2026-61800

Exploitation requires network access to the Oracle Hyperion Financial Management application over HTTP and, per the CVSS vector (PR:H), a high-privileged authenticated session within HFM. The affected version is specifically 11.2.25.0.000; no other versions are confirmed affected. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning once privilege and network access conditions are met, exploitation is straightforward. A significant unresolved condition is introduced by the 'Authentication Bypass' intelligence tag: if accurate, the PR:H requirement may not hold and unauthenticated remote exploitation may be possible - limiting factors in that scenario would be reduced to network reachability alone. What definitively limits exploitation under the CVSS-as-stated interpretation is the PR:H requirement: exploitation is restricted to actors already holding high-privilege HFM credentials, substantially narrowing the threat population to insider actors or post-compromise scenarios.

The CVSS 3.1 score of 6.5 reflects a meaningful but bounded risk profile: AV:N/AC:L indicates straightforward network exploitation without special conditions, but PR:H sharply limits the attack surface to already-authenticated high-privileged users. This is a critical tension with the intelligence tag 'Authentication Bypass' - if the flaw genuinely bypasses authentication, PR:N would be expected and the real-world risk would be substantially higher. This discrepancy is unresolved and must be verified against the Oracle CPU advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis. In practice, if PR:H holds, exploitation is limited to insider threat actors or compromised administrator accounts, making this a medium-priority finding for most environments. If the Authentication Bypass tag is accurate and PR:N is the correct rating, risk escalates significantly for any internet-exposed HFM instance.

A high-privileged HFM administrator or a threat actor who has compromised admin credentials sends a specially crafted HTTP request to the Oracle Hyperion Financial Management Security component endpoint. The flaw allows the attacker to read all financial data accessible to the application - including consolidation data, ledger entries, and entity hierarchies - or to trigger a repeated crash of the HFM service, causing a denial of service to all dependent finance users. If the Authentication Bypass tag reflects a true pre-auth condition, an unauthenticated external attacker with HTTP reach to the HFM server could achieve the same outcome without credential compromise.