Hyperion Financial Management EUVD-2026-61882

Exploitation requires a valid low-privileged account on the Oracle Hyperion Financial Management instance (PR:L per CVSS vector - anonymous or unauthenticated access is NOT sufficient). The attacker must have network access to the HFM application via HTTP (AV:N), meaning the HFM web interface must be reachable from the attacker's network segment. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race condition, special timing, or configuration manipulation is needed beyond possessing a low-privileged credential. The vulnerability is specific to version 11.2.25.0.000 of HFM and the Security component. Limiting factors: requires at minimum one valid HFM account (limits anonymous internet exploitation); scope is unchanged (S:U), so lateral movement to other systems is not directly implied by this CVE alone. Deployments where HFM is only accessible from trusted internal network segments face meaningfully lower practical risk than internet-exposed instances.

The CVSS 3.1 score of 7.1 (High) is driven primarily by the C:H (complete confidentiality loss) metric, which is the dominant risk signal here - HFM holds sensitive consolidated financial data, making unauthorized disclosure a material compliance and business risk (SOX, GDPR, financial confidentiality). The A:L (partial DoS) adds to the score but is secondary in business impact. Attack complexity is Low and no user interaction is required, making exploitation mechanically straightforward for anyone holding a valid low-privileged account. The 'Authentication Bypass' tag warrants attention: it may indicate that a low-privileged user can bypass higher-privilege role checks rather than the system being exploitable without any credentials, which is consistent with PR:L rather than PR:N. EPSS data is not available in the provided intelligence. No CISA KEV listing and no public proof-of-concept are confirmed at time of analysis, limiting the urgency slightly. However, the network-accessible, low-complexity nature means organizations should treat patching as time-sensitive given HFM's exposure to financial data. One signal conflict to note: the 'Authentication Bypass' tag implies a security control failure, yet PR:L confirms some authentication barrier exists - defenders should not assume the system is exploitable by anonymous users.

An attacker with a valid low-privileged HFM account - such as a read-only finance analyst or a compromised service account - sends crafted HTTP requests to the Security component of Oracle Hyperion Financial Management 11.2.25.0.000. By exploiting the access control flaw in the Security component, the attacker escalates their effective data access to retrieve all financial consolidation data accessible within HFM, including sensitive consolidated financial statements and management reports. The same or a follow-on request can trigger partial degradation of the HFM service, impacting availability for legitimate users. No public proof-of-concept is confirmed, but the low attack complexity suggests this is achievable without specialized tooling.