CVE-2026-70943

Analyzed Analyzed - Analysis Complete

Unauthenticated Data Manipulation in Oracle Hyperion Financial Management

Publication date: 2026-08-18

Last updated on: 2026-08-24

Assigner: Oracle

Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-24

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-70943

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	hyperion_financial_management	11.2.25.0.000

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Hyperion Financial Management version 11.2.25.0.000. It allows an unauthenticated attacker with access to the physical network segment where the system runs to exploit it. The flaw enables unauthorized actions like creating, deleting, or modifying critical data, or gaining full access to all data managed by the system.

Detection Guidance

This vulnerability requires physical or local network access to the segment where Oracle Hyperion Financial Management operates. Detection may involve monitoring network traffic for unauthorized access attempts or unusual data modifications. Check for unpatched versions of Oracle Hyperion Financial Management 11.2.25.0.000 and verify physical network segment security.

Impact Analysis

If you use Oracle Hyperion Financial Management version 11.2.25.0.000, an attacker on the same physical network could compromise your system. This may lead to unauthorized data access, modification, or deletion, potentially causing financial loss, data breaches, or operational disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Isolate the Oracle Hyperion Financial Management system from untrusted networks. Apply Oracle's official security patches or updates for version 11.2.25.0.000 as soon as they are available. Restrict physical and network access to the hardware hosting the application to trusted users only.

Hi! I’m here to help you understand CVE-2026-70943. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70