Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-18T21:17:28.113Z",
  "pubdate": "2026-08-18T21:17:28.113Z",
  "executiveSummary": "A security vulnerability has been identified within the Oracle Hyperion Financial Reporting product, specifically affecting the Server component in version 11.2.25.0.000. This vulnerability is classified as an easily exploitable flaw that can be leveraged by a low-privileged attacker with network access via the HTTP protocol. Successful exploitation of this security issue compromises the integrity and confidentiality of the targeted Oracle Hyperion Financial Reporting deployment.\nThe risk implications are significant, as a successful attack can grant unauthorized access to critical data or provide complete access to all data accessible via Oracle Hyperion Financial Reporting. Additionally, attackers can gain unauthorized update, insert, or delete access to a subset of the accessible data within the application. The attack requires human interaction from an individual other than the attacker to successfully execute the exploitation chain.",
  "technicalDetails": "The vulnerability resides in the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. The attack vector is network-based via HTTP, allowing remote threat actors to reach the vulnerable interface without requiring physical access or local system presence. The privilege requirement is low, meaning the attacker must possess authenticated access to the application at a baseline privilege level.\nExploitation mechanics involve network-based interaction where an attacker leverages the HTTP interface of the vulnerable server. The attack requires user interaction, meaning a victim (such as another user or administrator) must perform an action—such as clicking a malicious link or interacting with crafted web content—to facilitate the attack vector. According to the CVSS 3.1 metric vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N), the attack complexity is low (AC:L), and the scope remains unchanged (S:U).\nUpon successful exploitation, the impact on confidentiality is high (C:H), enabling unauthorized read access to critical or all application-accessible data. The impact on integrity is low (I:L), permitting unauthorized modification, insertion, or deletion of a portion of the application data. The availability impact is none (A:N), as the attack vector does not cause denial of service conditions against the targeted server component."
}