CVE-2026-70917: Infoleak
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 4.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Hyperion Financial Management (Security component)to a version that resolves this vulnerability.Fixed in 11.2.25.0.000
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems running Oracle Hyperion Financial Management version 11.2.25.0.000 are affected. Exploitation requires an attacker to have access to the infrastructure where the product executes, so the attack vector is local rather than network-based.
Does an attacker need an Oracle Hyperion Financial Management account?
No product-level privileges are required; the vulnerability is described as exploitable by an unauthenticated attacker. However, the attacker must be able to log on to the underlying infrastructure hosting Oracle Hyperion Financial Management.
What is the impact of successful exploitation?
A successful attack can provide unauthorized read access to a subset of data accessible through Oracle Hyperion Financial Management. The stated impact is limited to confidentiality; integrity and availability impacts are not identified.