Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:28.007Z",
  "pubdate": "2026-08-18T21:17:28.007Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Server component of the Oracle Hyperion Financial Reporting product, specifically affecting version 11.2.25.0.000. This security flaw enables unauthenticated remote threat actors to leverage network-based HTTP vectors to compromise the confidentiality of the targeted application. Successful exploitation of this vulnerability yields unauthorized access to critical enterprise data, potentially exposing all accessible records managed within the Oracle Hyperion Financial Reporting environment. Given that the vulnerability requires no user interaction, low attack complexity, and zero prior authentication privileges from the attacker, it poses a severe risk to organizational data security. The CVSS 3.1 base score is recorded at 7.5, reflecting a high-severity impact exclusively directed at confidentiality, with no direct integrity or availability disruption reported under the specific vector metrics.",
  "technicalDetails": "The vulnerability resides within the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000, exposed directly through the HTTP protocol. From an architectural perspective, the application fails to properly enforce access control mechanisms or adequately validate unauthenticated client requests destined for sensitive reporting resources. The attack vector is strictly network-based (AV:N), meaning an adversary does not require physical or local system access, and can initiate exploitation remotely over standard web protocols. The attack complexity is rated as low (AC:L), indicating that the targeted endpoint lacks robust protective barriers against automated scanning or scripted exploitation attempts. Furthermore, the vulnerability requires no privileges (PR:N) and no user interaction (UI:N), allowing unauthenticated threat actors to directly issue specially crafted HTTP requests to the vulnerable server endpoint. Upon receipt of the malicious request, the vulnerable Server component improperly processes input parameters or bypasses authentication routines, thereby exposing restricted data structures. The attack flow initiates when the remote adversary sends an unauthenticated HTTP request targeting the vulnerable server component. Because the application fails to validate the caller's authorization state, it processes the request and returns the requested payload containing sensitive enterprise data. The post-exploitation impact is characterized by a complete compromise of data confidentiality (C:H), granting the unauthorized actor read access to critical financial reports and proprietary data stores managed by the Oracle Hyperion Financial Reporting instance. The vulnerability scope remains unchanged (S:U), meaning the impact is contained within the vulnerable component itself without escalating privileges to underlying host operating systems or out-of-scope enterprise applications."
}