CVE-2026-71117: High severity Oracle Oracle Hyperion Financial Management vulnerability
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Organizations running Oracle Hyperion Financial Management version 11.2.25.0.000 are affected. Exploitation requires a high-privileged attacker who can log on to the infrastructure where the product executes, so the primary exposure is to compromised or malicious privileged infrastructure users.
Does exploitation require remote access or user interaction?
The CVSS vector identifies the attack vector as local and user interaction as none. An attacker must already have high privileges and logon access to the host infrastructure; no separate user action is required.
What is the potential impact of a successful attack?
A successful attacker can take over Oracle Hyperion Financial Management, with high confidentiality, integrity, and availability impact. Because the scope changes, the attack may also significantly affect additional products.
How difficult is exploitation?
Exploitation is rated as high complexity and is described as difficult to exploit. However, the required privileges are high, so this should still be prioritized where privileged host access is broadly available or insufficiently controlled.