Oracle Hyperion Financial Management EUVD-2026-61916

Exploitation requires possession of a valid low-privileged account on the Oracle Hyperion Financial Management instance (CVSS PR:L confirmed by vendor vector) and network-level HTTP access to the affected HFM server running version 11.2.25.0.000. The vulnerability specifically targets the Security component via HTTP. No user interaction by a higher-privileged victim is required (UI:N). Limiting factors include: the requirement for at least low-level authenticated access - unauthenticated external attackers cannot directly exploit this without first obtaining credentials; network reachability of the HFM HTTP service, which in most enterprise deployments is not internet-facing; and the single explicitly confirmed affected version (11.2.25.0.000), which bounds the vulnerable population to organizations on that specific build. The scope is unchanged (S:U), meaning successful exploitation does not extend compromise beyond the HFM application boundary.

The CVSS 3.1 base score of 6.5 (Medium) accurately encodes the attack vector and confidentiality impact but may understate operational risk in financial environments where HFM holds sensitive consolidation, audit, and reporting data. The AV:N/AC:L combination signals low barrier to exploitation for any authenticated low-privilege user, and the S:U scope constraint limits blast radius to HFM-accessible data only - no lateral movement to adjacent systems is implied. No EPSS score is available from the provided data, limiting probabilistic exploitation likelihood assessment. No CISA KEV listing and no publicly known POC are present at time of analysis, indicating no confirmed widespread exploitation. However, Oracle's own 'easily exploitable' characterization in the CVE description is a meaningful signal from the discoverer. For organizations where HFM data sensitivity is high, the practical risk exceeds what the medium CVSS score implies - this should be treated as a priority patch within the Oracle CPU cycle. No conflicting signals are present in the available data, but the absence of a CWE leaves the specific bypass mechanism unconfirmed.

A low-privileged HFM user - such as a read-only analyst or recently onboarded employee - authenticates to the Hyperion Financial Management web interface and sends crafted HTTP requests targeting the Security component, bypassing authorization checks to enumerate or extract financial consolidation data scoped to higher-privileged users or restricted reporting units. No public proof-of-concept has been identified, but Oracle's 'easily exploitable' characterization suggests exploitation requires no specialized tooling beyond standard HTTP interaction once a valid low-privilege credential is obtained.