CVE-2026-70740

CriticalCVSS 9.8

Published: 18/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Summary

Vulnerability in Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. Easily exploitable by an unauthenticated attacker over HTTP, allowing takeover of the system. CVSS score 9.8.

Risk Assessment

An attacker can fully compromise the system, leading to loss of confidentiality, integrity, and availability of financial data.

Recommendation

Apply patches provided by Oracle and restrict HTTP access to trusted networks only.

Original NVD description (English source)

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).