CVE-2026-70975 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Hyperion Financial Management version 11.2.25.0.000 should prioritize patching this vulnerability to prevent potential data breaches. Security teams and administrators responsible for Oracle Hyperion Financial Management deployments must review and apply Oracle's security patches. Affected operators and platform administrators should ensure that necessary personnel are informed and that patching is scheduled through normal change control processes. Vulnerability management teams should track exceptions and retest remediated assets to ensure the vulnerability is properly addressed. Monitoring and detection teams should review relevant logs for exposed assets that need extra review. Asset inventory management should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Rollback/change window management should plan for vendor-supported updates or mitigations where exposure is confirmed. Source tracking should be used to verify the authenticity of advisories and patches. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. The CVE record indicates a medium priority given the CVSS score of 6.5 and the potential for unauthorized access to critical data. Evidence is based on official CVE and NVD records, which provide details on the vulnerability and its potential impact. Defenders should verify the affected scope and severity based on the official advisory or CVE record. The vulnerability has a CVSS Vector of (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The CVE-2026-70975 record indicates a vulnerability in Oracle Hyperion Financial Management, with a CVSS score of 6.5. The supported version affected is 11.2.25.0.000. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Hyperi

Technical summary

CVE-2026-70975 is a vulnerability in Oracle Hyperion Financial Management, specifically in the Security component. The affected version is 11.2.25.0.000. This vulnerability is easily exploitable by a low-privileged attacker with network access via HTTP, potentially leading to unauthorized access to critical data. The CVSS 3.1 Base Score is 6.5, with Confidentiality impacts. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management.

Defensive priority

Medium priority given the CVSS score of 6.5 and the potential for unauthorized access to critical data.

Recommended defensive actions

• Review and apply Oracle's security patches for Hyperion Financial Management version 11.2.25.0.000.
• Restrict network access to Oracle Hyperion Financial Management to only necessary personnel.
• Monitor Oracle Hyperion Financial Management systems for unauthorized access attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE-2026-70975 record indicates a vulnerability in Oracle Hyperion Financial Management, with a CVSS score of 6.5. The supported version affected is 11.2.25.0.000. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management, potentially leading to unauthorized access to critical data. Evidence is based on official CVE and NVD records.

Official resources