Oracle Hyperion Financial Management EUVD-2026-61875

Exploitation requires a valid low-privileged account on the Oracle Hyperion Financial Management instance (confirmed by CVSS PR:L) and network-level connectivity to the SQL-accessible Security component (confirmed by CVSS AV:N). No user interaction is required. The target must be running the specific version 11.2.25.0.000. Fully anonymous exploitation is not possible under the confirmed CVSS vector - an authenticated session is a hard prerequisite. Exploitation is further limited by network reachability: in environments where HFM is deployed behind a firewall with access restricted to internal financial users, the attacker pool is confined to those with internal network access and valid credentials. No special non-default configuration is described as required beyond running the affected version.

The CVSS 3.1 base score of 8.8 reflects genuine high severity: network-accessible, low complexity, low privileges required, and full confidentiality, integrity, and availability impact without scope change. Oracle's explicit 'easily exploitable' classification reinforces that the low attack complexity rating is not overstated. No EPSS score is available to quantify exploitation probability, and no CISA KEV listing or public POC has been identified at time of analysis. Despite the absence of confirmed active exploitation, the combination of low attack complexity and full-takeover impact means that even a mid-sized financial operations team in malbork running HFM 11.2.25.0.000 should treat this as urgent rather than deferring to a routine patching cycle. The primary limiting factor is the PR:L requirement - attackers must possess at least a low-privileged account - which provides marginal but real friction compared to fully unauthenticated attacks, and is the key differentiator between this and a critical-scored vulnerability.

An attacker who has obtained low-privileged HFM credentials - through phishing, credential stuffing against the organization's identity provider, or insider access - sends a crafted SQL payload targeting the Security component of a network-reachable HFM 11.2.25.0.000 instance. The malicious query exploits the vulnerability to bypass access controls or execute arbitrary database operations, escalating to full application takeover including exfiltration of sensitive financial consolidation data. No public exploit code has been identified at time of analysis, but Oracle's 'easily exploitable' language suggests the technique requires minimal expertise once credentials are in hand.