CVE-2026-70754
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Vulnerability in Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. An unauthenticated attacker with network access via HTTP can gain unauthorized read access to a subset of data. The attack is easy to exploit and requires no user interaction.
Risk Assessment
The risk is unauthorized access to part of financial data, potentially compromising confidentiality.
Recommendation
Apply Oracle patches and consider restricting network access to the Hyperion server.
Other vulnerabilities in Oracle Hyperion Financial Reporting
See all- CVE-2026-70745Critical
Vulnerability in Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. Easily exploitable by an unauthenticated attacker over HTTP, allowing takeover of the system. CVSS score 9.8.
- CVE-2026-70741Critical
Vulnerability in Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. Easily exploitable by an unauthenticated attacker over RMI, allowing unauthorized data access and modification. CVSS score 9.1.
- CVE-2026-70740Critical
Vulnerability in Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. Easily exploitable by an unauthenticated attacker over HTTP, allowing takeover of the system. CVSS score 9.8.
- CVE-2026-70739Critical
Vulnerability in Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. Easily exploitable by an unauthenticated attacker over HTTP, allowing takeover of the system. CVSS score 9.8.
- CVE-2026-70794Medium
Vulnerability in Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. A difficult-to-exploit flaw allows a low-privileged attacker with logon access to compromise data integrity. Attacks can result in unauthorized creation, deletion, or modification of data.
- CVE-2026-70793Medium
Vulnerability in Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to compromise confidentiality and integrity. Attacks can result in unauthorized modification of some data and unauthorized read access to a subset of data.
- CVE-2026-70789Medium
Vulnerability in Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. Difficult to exploit, requires user interaction, allows unauthenticated attacker via HTTP to gain unauthorized access to critical data or full access to all data and modify some data.
- CVE-2026-70788Medium
Vulnerability in Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. Easily exploitable, allows unauthenticated attacker via HTTP to perform unauthorized update, insert or delete of some data and read a subset of data.
- CVE-2026-70787High
Vulnerability in Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. A low-privileged attacker can compromise the system via HTTP. Easily exploitable, CVSS 8.8.
- CVE-2026-70785Low
Vulnerability in Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. An unauthenticated attacker with network access via HTTP can exploit this to gain unauthorized read access to a subset of data. CVSS 3.1: 3.7 (Confidentiality impact).
Original NVD description (English source)
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS