Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Reporting accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:17:27.450Z",
  "pubdate": "2026-08-18T21:17:27.450Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000, presenting significant risk to organizational data integrity and confidentiality.\nThe vulnerability allows an unauthenticated remote attacker with network access via the HTTP protocol to compromise the affected application.\nSuccessful exploitation requires human interaction from an individual other than the attacker, such as a user interacting with a malicious link or crafted interface.\nThe primary risk implications involve severe impacts on data confidentiality and integrity, enabling unauthorized users to read, create, modify, or delete critical enterprise data accessible via Oracle Hyperion Financial Reporting.\nGiven the network vector and lack of authentication requirements, unauthorized external actors can target the HTTP service directly, leveraging user interaction to bypass perimeter defenses and execute unauthorized data operations.\nOrganizations deploying the affected version must prioritize remediation actions to prevent potential data breaches and unauthorized manipulation of sensitive financial reporting repositories.",
  "technicalDetails": "The vulnerability resides in the Server component of Oracle Hyperion Financial Reporting, specifically affecting version 11.2.25.0.000.\nThe attack vector is network-based (AV:N), allowing remote entities to interact with the vulnerable application over HTTP without requiring prior authentication (PR:N) or low attack complexity (AC:L).\nHowever, successful exploitation mandates user interaction (UI:R), meaning an attacker must induce a third-party user to perform a specific action, such as clicking a malicious link or loading a specially crafted web page within the context of the application session.\nThe scope of the vulnerability is unchanged (S:U), but the impact metrics for both confidentiality (C:H) and integrity (I:H) are rated as high, while availability (A:N) remains unaffected, yielding a CVSS 3.1 base score of 8.1.\nThe step-by-step attack flow begins when an unauthenticated attacker crafts a malicious HTTP payload designed to interact with the vulnerable Oracle Hyperion Financial Reporting Server component.\nThe attacker then delivers this payload to a targeted user via social engineering or other web-based mechanisms, initiating the required human interaction.\nUpon the victim interacting with the malicious request within the application session, the server processes the incoming parameters without adequate validation or sanitization.\nThis improper handling allows the attacker to execute unauthorized commands or transmit requests that bypass standard access controls.\nAs a result of this post-exploitation state, the attacker gains unauthorized read, write, creation, and deletion capabilities over critical data stored within or accessible by Oracle Hyperion Financial Reporting, severely compromising the confidentiality and integrity of the financial reporting infrastructure."
}