CVE-2026-70793

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cspuaug2026.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:hyperion_financial_reporting:11.2.25.0.000:*:*:*:*:*:*:*

History

22 Oct 2026, 19:09

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad en el producto Oracle Hyperion Financial Reporting de Oracle Hyperion (componente: Servidor). La versión compatible afectada es 11.2.25.0.000. Vulnerabilidad difícil de explotar permite a un atacante con pocos privilegios con acceso a la red a través de HTTP comprometer Oracle Hyperion Financial Reporting. Ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de actualización, inserción o eliminación a algunos de los datos accesibles de Oracle Hyperion Financial Reporting, así como acceso de lectura no autorizado a un subconjunto de los datos accesibles de Oracle Hyperion Financial Reporting. Puntuación Base CVSS 3.1 de 4.2 (impactos en la Confidencialidad e Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).

Information

Published : 2026-08-18 21:17

Updated : 2026-10-22 19:09

NVD link : CVE-2026-70793

Mitre link : CVE-2026-70793

CVE.ORG link : CVE-2026-70793

JSON object : View

Products Affected

oracle

hyperion_financial_reporting

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-70793", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70793", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T13:55:11.914456Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle Hyperion Financial Reporting", "versions": [{"status": "affected", "version": "11.2.25.0.000", "versionType": "semver"}]}]}], "published": "2026-08-18T21:17:33.103", "references": [{"url": "https://www.oracle.com/security-alerts/cspuaug2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Hyperion Financial Reporting de Oracle Hyperion (componente: Servidor). La versi\u00f3n compatible afectada es 11.2.25.0.000. Vulnerabilidad dif\u00edcil de explotar permite a un atacante con pocos privilegios con acceso a la red a trav\u00e9s de HTTP comprometer Oracle Hyperion Financial Reporting. Ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de actualizaci\u00f3n, inserci\u00f3n o eliminaci\u00f3n a algunos de los datos accesibles de Oracle Hyperion Financial Reporting, as\u00ed como acceso de lectura no autorizado a un subconjunto de los datos accesibles de Oracle Hyperion Financial Reporting. Puntuaci\u00f3n Base CVSS 3.1 de 4.2 (impactos en la Confidencialidad e Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)."}], "lastModified": "2026-10-22T19:09:59.383", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:hyperion_financial_reporting:11.2.25.0.000:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C62FFD11-D3BC-4AE7-9DFB-C9ED606331E8"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}