cve-2026-70742
HIGH CVSS 8.8 opencve
Description
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Timeline
- Published
- 2026-08-18 21:17 UTC
- Last Modified
- 2026-08-25
CVSS Details
CVSS details not available.
Affected Products
No product information available.
CVSS metrics
| Version | Base | Severity | Vector | Exploitability | Impact | Source |
|---|---|---|---|---|---|---|
| 3.1 | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
mitre | ||
| 3.1 | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
nvd | ||
| 3.1 | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
opencve |
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cve": "CVE-2026-70742",
"enrichment": {
"affected": [
{
"configurations": [
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "generic",
"value": "11.2.25.0.000"
}
}
],
"enrichment": {
"confidence": 95.0,
"confidence_source": "inferred",
"scores": [
{
"score": 95.0,
"source": "inferred"
},
{
"score": 100.0,
"source": "matching"
}
]
},
"original": {
"product": "Oracle Hyperion Financial Reporting",
"source": "cna",
"vendor": "Oracle Corporation"
},
"product": "hyperion_financial_reporting",
"vendor": "oracle"
}
],
"created": "2026-08-19T04:30:05.254143+00:00",
"title": "Low Privileged HTTPS Access‑Control Flaw Enables Full Takeover of Oracle Hyperion Financial Reporting",
"updated": "2026-08-25T21:30:06.896714+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$hyperion_financial_reporting"
]
},
"epss": {
"score": 0.00432
},
"mitre": {
"cpes": [
"cpe:2.3:a:oracle:hyperion_financial_reporting:11.2.25.0.000:*:*:*:*:*:*:*"
],
"created": "2026-08-18T21:01:19.167000+00:00",
"description": "Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 8.8,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"mitre_repo_path": "cves/2026/70xxx/CVE-2026-70742.json",
"references": [
"https://www.oracle.com/security-alerts/cspuaug2026.html"
],
"title": null,
"updated": "2026-08-25T15:09:57.475000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$hyperion_financial_reporting"
],
"weaknesses": []
},
"nvd": {
"cpes": [
"cpe:2.3:a:oracle:hyperion_financial_reporting:11.2.25.0.000:*:*:*:*:*:*:*"
],
"created": "2026-08-18T21:17:27.007000+00:00",
"description": "Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 8.8,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"nvd_repo_path": "2026/CVE-2026-70742.json",
"references": [
"https://www.oracle.com/security-alerts/cspuaug2026.html"
],
"title": null,
"updated": "2026-08-25T16:18:10.053000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$hyperion_financial_reporting"
],
"weaknesses": [
"CWE-284"
]
},
"opencve": {
"changes": [
{
"created": "2026-08-18T21:15:00+00:00",
"data": [
{
"details": {
"new": "Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
"old": null
},
"type": "description"
},
{
"details": [
"oracle",
"oracle$PRODUCT$hyperion_financial_reporting"
],
"type": "first_time"
},
{
"details": {
"added": [
"cpe:2.3:a:oracle:hyperion_financial_reporting:11.2.25.0.000:*:*:*:*:*:*:*"
],
"removed": []
},
"type": "cpes"
},
{
"details": {
"added": [
"oracle",
"oracle$PRODUCT$hyperion_financial_reporting"
],
"removed": []
},
"type": "vendors"
},
{
"details": {
"added": [
"https://www.oracle.com/security-alerts/cspuaug2026.html"
],
"removed": []
},
"type": "references"
},
{
"details": {
"added": {
"cvssV3_1": {
"score": 8.8,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "912b40ce-5da4-4493-9aa9-c6f6d8c23620"
},
{
"created": "2026-08-19T11:00:00+00:00",
"data": [
{
"details": {
"new": "Remote Oracle Hyperion Server Takeover via Low-Privilege HTTPS Access",
"old": null
},
"type": "title"
},
{
"details": {
"added": [
"CWE-284",
"CWE-287"
],
"removed": []
},
"type": "weaknesses"
}
],
"id": "f841e703-583b-4f5d-8421-e5f60aa3b77b"
},
{
"created": "2026-08-21T06:45:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Remote Oracle Hyperion Server Takeover via Low-Privilege HTTPS Access"
},
"type": "title"
},
{
"details": {
"added": [],
"removed": [
"CWE-284",
"CWE-287"
]
},
"type": "weaknesses"
}
],
"id": "c2c2ec7b-3feb-4d84-81c4-4b568c2da636"
},
{
"created": "2026-08-21T08:15:00+00:00",
"data": [
{
"details": {
"new": "Remote Takeover via HTTPS in Oracle Hyperion Financial Reporting",
"old": null
},
"type": "title"
},
{
"details": {
"added": [
"CWE-285"
],
"removed": []
},
"type": "weaknesses"
}
],
"id": "d393b2d5-c705-4f3a-89a0-063e639a5127"
},
{
"created": "2026-08-25T15:30:00+00:00",
"data": [
{
"details": {
"added": [
"CWE-284"
],
"removed": []
},
"type": "weaknesses"
}
],
"id": "3af02b6a-656b-4d1a-825e-a4c3f4a01c49"
},
{
"created": "2026-08-25T16:30:00+00:00",
"data": [
{
"details": {
"added": {
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "44404bda-909a-4acd-bb0a-edc527ebd0fa"
},
{
"created": "2026-08-25T18:00:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Remote Takeover via HTTPS in Oracle Hyperion Financial Reporting"
},
"type": "title"
},
{
"details": {
"added": [],
"removed": [
"CWE-285"
]
},
"type": "weaknesses"
}
],
"id": "4f028570-cdc1-4eab-850f-17f4bbb128a3"
},
{
"created": "2026-08-25T21:45:00+00:00",
"data": [
{
"details": {
"new": "Low Privileged HTTPS Access‑Control Flaw Enables Full Takeover of Oracle Hyperion Financial Reporting",
"old": null
},
"type": "title"
}
],
"id": "f5b47501-18d2-4b22-ada5-8f17c8df74e2"
}
],
"cpes": {
"data": [
"cpe:2.3:a:oracle:hyperion_financial_reporting:11.2.25.0.000:*:*:*:*:*:*:*"
],
"providers": [
"mitre",
"nvd"
]
},
"created": {
"data": "2026-08-18T21:01:19.167000+00:00",
"provider": "mitre"
},
"description": {
"data": "Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
"provider": "mitre"
},
"metrics": {
"cvssV2_0": {
"data": {},
"provider": null
},
"cvssV3_0": {
"data": {},
"provider": null
},
"cvssV3_1": {
"data": {
"score": 8.8,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"provider": "mitre"
},
"cvssV4_0": {
"data": {},
"provider": null
},
"epss": {
"data": {
"score": 0.00432
},
"provider": "first"
},
"kev": {
"data": {},
"provider": null
},
"ssvc": {
"data": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
},
"provider": "vulnrichment"
},
"threat_severity": {
"data": null,
"provider": null
}
},
"references": {
"data": [
"https://www.oracle.com/security-alerts/cspuaug2026.html"
],
"providers": [
"mitre",
"nvd"
]
},
"title": {
"data": "Low Privileged HTTPS Access‑Control Flaw Enables Full Takeover of Oracle Hyperion Financial Reporting",
"provider": "enrichment"
},
"updated": {
"data": "2026-08-25T21:30:06.896714+00:00",
"provider": "enrichment"
},
"vendors": {
"data": [
"oracle",
"oracle$PRODUCT$hyperion_financial_reporting"
],
"providers": [
"mitre",
"nvd",
"enrichment"
]
},
"weaknesses": {
"data": [
"CWE-284"
],
"providers": [
"nvd",
"vulnrichment"
]
}
},
"vulnrichment": {
"cpes": [],
"created": "2026-08-18T21:01:19.167000+00:00",
"description": "Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {},
"kev": {},
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"references": [],
"title": null,
"updated": "2026-08-25T15:06:27.528000+00:00",
"vendors": [],
"vulnrichment_repo_path": "2026/70xxx/CVE-2026-70742.json",
"weaknesses": [
"CWE-284"
]
}
}