Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-18T21:17:29.183Z",
  "pubdate": "2026-08-18T21:17:29.183Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. This security flaw allows unauthenticated remote threat actors with network access via the HTTP protocol to compromise the affected application. Successful exploitation of this vulnerability necessitates human interaction from a victim other than the attacker. Due to a scope change, successful attacks can extend beyond the primary Oracle Hyperion Financial Reporting product to significantly impact additional secondary products within the environment.\nThe impact of successful attacks encompasses unauthorized read access to a subset of data accessible by Oracle Hyperion Financial Reporting, alongside unauthorized update, insert, or delete access to certain data resources. The Common Vulnerability Scoring System (CVSS) version 3.1 assigns a base score of 6.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, highlighting the primary risks to confidentiality and integrity without resulting in a direct availability denial.",
  "technicalDetails": "The vulnerability resides in the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000, exposed directly through network interfaces over HTTP. The attack vector is strictly network-based (AV:N), requiring low attack complexity (AC:L) and zero pre-existing authentication privileges (PR:N). However, successful execution is contingent upon targeted human interaction (UI:R), such as tricking an authenticated or interacting user into processing a malicious payload or navigating to a crafted resource.\nThe exploitation flow initiates when an unauthenticated remote attacker crafts an HTTP-based request designed to interact with the vulnerable Oracle Hyperion Financial Reporting Server component. Because the vulnerability involves a scope change (S:C), the impact breaches the administrative and security boundaries of the initial application component, propagating to interconnected or downstream products supported within the architecture. When the victim interacts with the malicious stimulus, the application executes unauthorized operations dictated by the attacker's payload.\nPost-exploitation impacts include compromised data integrity and confidentiality. Attackers achieve unauthorized read access (C:L) to sensitive subsets of data managed by Oracle Hyperion Financial Reporting, as well as unauthorized data manipulation capabilities—specifically insert, update, and delete access (I:L)—concerning application-accessible records. The absence of an availability impact (A:N) indicates that the core functionality and uptime of the targeted server remain unaffected during the attack sequence, focusing the exploitation entirely on data state modification and unauthorized information disclosure across the scoped environment."
}