CVE-2026-70752 in Hyperion Financial Reporting
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the server component of Oracle Hyperion Financial Reporting, specifically affecting version 11.2.25.0.000 and potentially other supported releases in that lineage. This security flaw represents a critical weakness in the application's authentication and access control mechanisms, allowing for unauthorized entry into the system without requiring valid credentials. The nature of this defect aligns with CWE-287, which describes Improper Authentication, where an attacker is able to bypass or circumvent established identity verification processes. By exploiting this deficiency, a remote actor can gain foothold within the application environment through standard network protocols, specifically leveraging HTTP connections to interact with the vulnerable server endpoints.
The operational impact of this vulnerability is severe due to its high exploitability and lack of prerequisites for attacker authentication. An unauthenticated adversary possessing basic network connectivity to the target system can initiate an attack without needing prior access or social engineering efforts such as user interaction. This characteristic corresponds closely with MITRE ATT&CK technique T1078, Valid Accounts, although in this specific context, it manifests more accurately as unauthorized initial access through broken authentication controls rather than stolen credentials. The ease of exploitation means that automated scanning tools and opportunistic attackers can rapidly identify and compromise vulnerable instances across the internet or internal networks if proper segmentation is not enforced.
Upon successful exploitation, the attacker achieves a high level of confidentiality impact, classified with a CVSS 3.1 Base Score of 7.5. This score reflects the ability to access critical data stored within the Oracle Hyperion Financial Reporting environment. The vulnerability does not appear to grant immediate control over system integrity or availability in terms of modifying configurations or disrupting service uptime, as indicated by zero impact on Integrity and Availability in the CVSS vector. However, the complete compromise of confidentiality means that sensitive financial reports, proprietary business metrics, and confidential organizational data become accessible to the attacker. This exposure violates core security principles regarding data privacy and intellectual property protection, potentially leading to significant regulatory penalties under frameworks such as GDPR or SOX if personal or financial data is exposed.
Mitigation strategies must focus on immediate isolation and patching of the affected software version. Organizations running Oracle Hyperion Financial Reporting 11.2.25.0.000 should apply the latest security patches provided by Oracle to address this authentication bypass flaw. In scenarios where patching cannot be implemented immediately, network-level controls such as firewalls or web application firewalls should be configured to restrict access to the vulnerable HTTP endpoints exclusively from trusted IP addresses and internal subnets. Additionally, implementing strict input validation and enforcing robust session management policies can help mitigate similar risks in related components. Continuous monitoring of access logs for anomalous authentication patterns is also recommended to detect potential exploitation attempts early.