Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T21:17:26.667Z",
  "pubdate": "2026-08-18T21:17:26.667Z",
  "executiveSummary": "A critical security vulnerability has been identified within the Oracle Hyperion Financial Reporting product, specifically residing in the Server component. This remotely exploitable flaw affects version 11.2.25.0.000 and poses severe risks to organizational infrastructure.\nThe vulnerability allows an unauthenticated remote attacker to compromise the affected system entirely over the network via HTTP. Successful exploitation yields complete control over the Oracle Hyperion Financial Reporting application, resulting in full impact across all the primary pillars of information security: confidentiality, integrity, and availability. With a CVSS 3.1 base score of 9.8, this flaw represents a maximum severity rating.\nThe attack vector requires no user interaction, low complexity, and zero prior authentication privileges, making it highly attractive to malicious actors seeking initial access or lateral movement within an enterprise network. The business implications of a full application takeover include potential exposure of sensitive financial data, unauthorized modification of reporting structures, and complete disruption of financial reporting services.",
  "technicalDetails": "The vulnerability exists within the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. It manifests as a remotely exploitable flaw accessible via the HTTP protocol over the network, allowing threat actors to bypass authentication and authorization boundaries implemented by the application.\nThe attack flow begins when an unauthenticated attacker crafts a specialized HTTP request directed at the vulnerable endpoints of the Oracle Hyperion Financial Reporting Server. Due to inadequate input validation, improper authentication enforcement, or flawed session management within the affected component, the application fails to properly validate the identity and privileges of the incoming request.\nUpon receiving the malicious payload, the vulnerable server processes the input in a manner that permits arbitrary command execution, deserialization abuse, or unauthorized administrative function invocation, depending on the underlying flaw class. Because the service typically runs with elevated privileges on the host operating system, successful execution of the exploit code allows the adversary to achieve complete system or application takeover.\nThe exploitation prerequisites are minimal: the target must be reachable over the network via HTTP, and the affected version 11.2.25.0.000 must be deployed without compensating controls. The attacker does not require valid credentials, administrative privileges, or any form of user interaction to initiate or complete the attack sequence.\nThe post-exploitation impact is total compromise. An attacker who successfully executes this vulnerability gains the ability to read, modify, or delete sensitive financial data, inject malicious code into the reporting workflow, disrupt service availability, and potentially pivot to other connected internal systems within the enterprise architecture."
}