CVE-2026-70736 in Hyperion Profitability and Cost Management
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Profitability and Cost Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Profitability and Cost Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Profitability and Cost Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Deployment component of Oracle Hyperion Profitability and Cost Management, specifically affecting version 11.2.25.0.000. This security flaw represents a significant risk to organizations relying on this enterprise performance management software for financial planning, analysis, and reporting. The core issue stems from an improper access control mechanism within the deployment interface, which fails to adequately enforce authentication or authorization checks before processing certain HTTP-based requests. As a result, individuals with low-privileged user accounts who possess network connectivity to the application can exploit this weakness without requiring any form of social engineering or user interaction. This characteristic aligns closely with CWE-284, Improper Access Control, where the system does not properly restrict access to resources for unauthorized actors.
The operational impact of exploiting this vulnerability is substantial due to its ease of exploitation and broad scope. An attacker can leverage network-accessible HTTP endpoints to gain unauthorized access to critical data stored within the Oracle Hyperion environment. This includes sensitive financial models, budgetary forecasts, cost allocations, and other proprietary business intelligence that forms the backbone of organizational decision-making processes. Beyond mere confidentiality breaches, the vulnerability also permits unauthorized modifications to this data. Attackers can perform update, insert, or delete operations on accessible datasets, leading to integrity violations that could distort financial reporting, manipulate key performance indicators, or corrupt historical records essential for regulatory compliance and audit trails.
From a threat intelligence perspective, this attack vector corresponds to ATT&CK technique T1078, Valid Accounts, as it relies on legitimate but low-privileged credentials being abused due to insufficient privilege separation in the application logic. Furthermore, the ability to modify data maps directly to ATT&CK tactic TA0043, Impact, specifically sub-techniques involving data manipulation or destruction. The CVSS 3.1 base score of 7.1 reflects a High severity rating, driven primarily by high confidentiality impact and low integrity impact, with no direct effect on availability in the current assessment. This scoring indicates that while system uptime may remain unaffected, the trustworthiness and secrecy of the data are severely compromised.
Mitigation strategies must focus immediately on restricting network access to the affected deployment components until a patch is applied. Organizations should implement strict firewall rules or web application firewalls to limit HTTP traffic from untrusted networks to only those IP addresses explicitly authorized for administrative functions. Additionally, enforcing multi-factor authentication and elevating privilege requirements for any action involving data modification can reduce the attack surface even if low-privileged accounts are compromised. It is critical to monitor logs for anomalous HTTP requests targeting deployment endpoints, particularly those originating from unexpected source IPs or exhibiting patterns consistent with automated exploitation tools. Oracle should be consulted promptly regarding available patches or workarounds specific to version 11.2.25.0.000 to permanently resolve the underlying access control deficiency and restore the integrity of the security posture surrounding this critical business application.