Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:17:28.230Z",
  "pubdate": "2026-08-18T21:17:28.230Z",
  "executiveSummary": "An information disclosure vulnerability has been identified within the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. This security flaw allows an unauthenticated remote attacker with network access via the HTTP protocol to interact with vulnerable endpoints and gain unauthorized read access to a subset of sensitive data managed by the application. The vulnerability carries a CVSS 3.1 Base Score of 5.3, impacting exclusively confidentiality without affecting system integrity or availability. Exploitation requires no user interaction, low attack complexity, and no prior privileges, making it accessible to external threat actors targeting exposed network interfaces. Risk implications include the potential exposure of proprietary financial metrics and internal reporting data, necessitating prompt remediation or defensive hardening actions by system administrators to restrict unauthorized access.",
  "technicalDetails": "The vulnerability resides in the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000, specifically within its HTTP request handling architecture. The root cause stems from insufficient access control enforcement and inadequate validation of incoming HTTP requests processed by the reporting server, allowing unauthorized clients to query resources that should be restricted.\nExploitation is conducted remotely over the network via the HTTP protocol. Because the vulnerability requires no authentication and no user interaction, an attacker can directly target the exposed HTTP service of the Oracle Hyperion Financial Reporting Server with crafted requests designed to bypass authorization checks on specific endpoints.\nThe attack flow proceeds as follows: First, the unauthenticated attacker establishes a network connection to the HTTP interface exposed by the vulnerable Oracle Hyperion Financial Reporting Server. Second, the attacker transmits a specially formatted HTTP request targeting a sensitive data retrieval function within the Server component. Third, due to the lack of proper privilege verification and authorization enforcement, the application processes the request and retrieves the targeted data from internal storage or database layers. Finally, the server responds by transmitting the requested data payload back to the attacker over HTTP, resulting in unauthorized read access to confidential reporting information.\nThe post-exploitation impact is strictly limited to confidentiality, enabling the adversary to harvest a subset of accessible data from Oracle Hyperion Financial Reporting. The attack complexity is low, and the vulnerability scope is unchanged (S:U), meaning the compromised component does not extend privileges to underlying host operating systems or adjacent architectural domains."
}