Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-18T21:17:29.540Z",
  "pubdate": "2026-08-18T21:17:29.540Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. This security flaw allows unauthenticated remote threat actors with network access via the HTTP protocol to compromise the affected system.\nSuccessful exploitation of this vulnerability requires human interaction from an individual other than the attacker, such as tricking a legitimate user into interacting with malicious content or a crafted request. While the primary vulnerability resides within Oracle Hyperion Financial Reporting, a scope change occurs, meaning successful attacks may significantly impact additional integrated or downstream products.\nThe impact of a successful attack compromises both data confidentiality and data integrity, resulting in unauthorized read access to a subset of accessible data, as well as unauthorized update, insert, or delete access to some of the data accessible by Oracle Hyperion Financial Reporting. The vulnerability carries a CVSS 3.1 Base Score of 6.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network vector exposure, low attack complexity, no required privileges, required user interaction, and a security scope change.",
  "technicalDetails": "The vulnerability affects the Server component of Oracle Hyperion Financial Reporting, specifically targeting version 11.2.25.0.000. The application exposes endpoints accessible via the HTTP protocol over the network, allowing unauthenticated remote entities to interact with vulnerable functions without requiring prior authentication or elevated privileges.\nThe attack flow begins when an unauthenticated attacker crafts a malicious HTTP-based payload targeting the vulnerable Oracle Hyperion Financial Reporting Server component. Because the vulnerability requires user interaction (UI:R), the attacker must successfully induce a victim—such as an authenticated administrator or privileged user—to execute a specific action, such as clicking a malicious link or navigating to a compromised web page that triggers the request against the target server.\nUpon successful execution and processing of the malicious input, the security scope changes (S:C), allowing the impact to extend beyond the immediate boundaries of Oracle Hyperion Financial Reporting to affect additional secondary products or system components. The resulting payload behavior enables unauthorized actors to bypass standard access controls, leading to limited confidentiality and integrity breaches.\nSpecifically, the post-exploitation impact grants the attacker unauthorized read access to a subset of data normally restricted within Oracle Hyperion Financial Reporting, alongside unauthorized update, insert, and delete capabilities against other accessible data stores. The attack vector relies on low attack complexity (AC:L), meaning standard network conditions and minimal technical hurdles are required for the exploit to succeed once the requisite human interaction is achieved."
}