Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Reporting executes to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:17:28.343Z",
  "pubdate": "2026-08-18T21:17:28.343Z",
  "executiveSummary": "An unauthenticated, low-privileged local attacker can exploit a vulnerability in the Oracle Hyperion Financial Reporting product, specifically within the Server component, version 11.2.25.0.000. The vulnerability is classified as difficult to exploit due to high attack complexity requirements, yet it necessitates only low privileges and local logon access to the underlying infrastructure where the application executes. Successful exploitation of this security flaw does not impact system availability or require user interaction, but it directly compromises data security by granting unauthorized read access to a subset of accessible data, as well as unauthorized creation, deletion, and modification access to critical or all accessible data within Oracle Hyperion Financial Reporting. The CVSS 3.1 Base Score is 5.3, with a vector of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N. Risk implications include severe integrity degradation and partial confidentiality breaches, highlighting the necessity of hardening local infrastructure controls and enforcing strict access boundaries around the affected server environment to prevent unauthorized local manipulation of application data assets.",
  "technicalDetails": "The vulnerability resides within the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. The attack vector is strictly local (AV:L), meaning an adversary must already possess interactive logon capabilities to the underlying operating system infrastructure hosting the target application. Furthermore, the attack complexity is rated as high (AC:H), indicating that successful exploitation requires specific environmental conditions, race conditions, or complex local configuration setups to be orchestrated by the threat actor.\nPrivilege requirements are constrained to low (PR:L), signifying that standard, unprivileged user accounts with local system access can potentially trigger the flaw. User interaction is not required (UI:N). The scope remains unchanged (S:U), as the compromise is confined to the resource boundaries of the affected Oracle Hyperion Financial Reporting server component rather than breaching underlying hypervisor or hyper-visor-adjacent virtualization layers.\nThe step-by-step attack flow involves an authenticated local user leveraging their low-privileged access to interact with insecurely configured file permissions, local inter-process communication channels, or improperly secured execution contexts managed by the Oracle Hyperion Financial Reporting Server. Because the application processes critical financial and reporting datasets, an attacker who successfully navigates the high complexity requirements can manipulate local file structures, execution parameters, or database interactions. This yields unauthorized write, creation, and deletion capabilities over critical data repositories (I:H), alongside unauthorized extraction of sensitive information constituting a subset of the application's accessible data pool (C:L). The vector confirms zero impact on availability (A:N), as the attack mechanics focus entirely on unauthorized data manipulation and disclosure rather than denial-of-service disruptions."
}