Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T21:17:28.483Z",
  "pubdate": "2026-08-18T21:17:28.483Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. This security flaw allows unauthenticated remote attackers with network access via the HTTP protocol to compromise the affected system, resulting in unauthorized data manipulation and disclosure risks.\nThe vulnerability requires human interaction from a victim other than the attacker to facilitate successful exploitation. The overarching impact includes unauthorized update, insert, or delete access to a subset of data accessible within Oracle Hyperion Financial Reporting, alongside unauthorized read access to sensitive subset data.\nWith a CVSS 3.1 Base Score of 5.4, the risk implications are moderate, focusing specifically on confidentiality and integrity impacts without affecting system availability. The attack vector is strictly network-based with low attack complexity, requiring no prior privileges but depending on user interaction vectors such as enticing a user to interact with a malicious HTTP payload or link.",
  "technicalDetails": "The vulnerability resides in the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. The root cause stems from improper handling or validation of incoming HTTP requests processed by the server, enabling malicious actors to leverage web-based vectors to interact with the application.\nExploitation of this vulnerability occurs remotely over the network using standard HTTP protocols. An unauthenticated attacker crafts a malicious request and delivers it to the target server. Because the vulnerability requires human interaction, the attack flow typically involves social engineering or client-side interaction where a legitimate user with access privileges is tricked into performing a specific action that triggers the flaw during their session.\nUpon successful execution, the attack payload bypasses standard authorization boundaries enforced by the application logic. This grants the attacker unauthorized read access to a subset of data stored or processed by Oracle Hyperion Financial Reporting, as well as unauthorized update, insert, or delete access to designated data elements.\nThe attack characteristics include network exposure (AV:N), low attack complexity (AC:L), zero required privileges (PR:N), and a mandatory user interaction requirement (UI:R). The scope remains unchanged (S:U), with direct consequences impacting the confidentiality (C:L) and integrity (I:L) of the application data while leaving availability (A:N) unaffected."
}