Description

Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Profitability and Cost Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Profitability and Cost Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Profitability and Cost Management. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T21:17:25.977Z",
  "pubdate": "2026-08-18T21:17:25.977Z",
  "executiveSummary": "A security vulnerability has been identified within the Deployment component of Oracle Hyperion Profitability and Cost Management version 11.2.25.0.000. This remotely exploitable vulnerability poses significant risk to enterprise financial modeling and cost management infrastructures by allowing low-privileged authenticated attackers to interact with vulnerable HTTP endpoints over the network.\nSuccessful exploitation of this security flaw grants unauthorized threat actors the capability to compromise the confidentiality and availability of the system. Specifically, an attacker can achieve unauthorized access to critical application data or complete access to all data accessible within Oracle Hyperion Profitability and Cost Management, while simultaneously possessing the capability to induce a partial denial of service (partial DoS) condition.\nThe vulnerability requires low privileges and network access via HTTP, but does not necessitate user interaction, lowering the barrier for internal malicious actors or compromised accounts to execute unauthorized operations. The associated CVSS 3.1 Base Score of 7.1 underscores the severity of the confidentiality and availability impacts, necessitating immediate remediation and strict access control enforcement across enterprise deployments.",
  "technicalDetails": "The vulnerability affects the Deployment component of Oracle Hyperion Profitability and Cost Management version 11.2.25.0.000. The flaw stems from insufficient input validation, authorization checks, or improper access control mechanisms enforced within the HTTP-based interfaces handling deployment operations.\nFrom an attack vector perspective, the vulnerability is classified under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L. The network attack vector (AV:N) indicates that the vulnerability can be exploited remotely across a network stack without requiring physical access to the host machine. The low attack complexity (AC:L) denotes that exploitation does not require specialized conditions or race-condition execution windows, making the attack surface reliably exploitable once access is established.\nAn attacker must possess low privileges (PR:L), meaning standard user authentication within the Oracle Hyperion ecosystem is required to initiate the attack sequence. However, no user interaction (UI:N) is mandated, allowing automated scripts or direct HTTP requests to trigger the vulnerability. The scope remains unchanged (S:U), restricting the direct impact to the vulnerable Oracle Hyperion Profitability and Cost Management component and its immediate datastore context.\nThe attack flow proceeds as follows: First, the low-privileged attacker establishes an HTTP connection to the vulnerable endpoints exposed by the Deployment component of Oracle Hyperion Profitability and Cost Management. Second, the attacker transmits crafted HTTP requests designed to bypass intended logical boundaries or leverage insecure direct object references and flawed access control logic. Third, the backend processing handles the request without adequately verifying whether the authenticated low-privileged user is authorized to access the requested deployment functions or data sets.\nUpon successful processing of the payload, the post-exploitation impact manifests in two primary ways: confidentiality breach and availability degradation. For confidentiality (C:H), the attacker gains unauthorized read access to critical enterprise financial data, sensitive cost management parameters, and potentially all stored data accessible to the application context. For availability (A:L), the attacker can exhaust system resources, corrupt deployment states, or disrupt application services, resulting in a partial denial of service that degrades operational capability for legitimate users."
}