Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Reporting executes to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Reporting accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-18T21:17:31.220Z",
  "pubdate": "2026-08-18T21:17:31.220Z",
  "executiveSummary": "A vulnerability has been identified within the Oracle Hyperion Financial Reporting product, specifically within the Server component version 11.2.25.0.000. This security flaw introduces significant risk regarding data confidentiality and integrity within enterprise financial management deployments.\nThe vulnerability allows an unauthenticated attacker to compromise the targeted application, leading to severe impacts on data assets. Successful exploitation grants the adversary unauthorized capabilities to create, delete, or modify critical data, as well as gain complete unauthorized access to all accessible data residing within the Oracle Hyperion Financial Reporting environment.\nExploitation of this flaw is characterized as difficult, requiring specific environmental conditions. Specifically, an attacker must have access to the physical communication segment attached to the underlying hardware where the Oracle Hyperion Financial Reporting service executes. Despite the requirement for local segment access, the absence of authentication prerequisites elevates the operational risk for environments lacking strict physical and layer-2 network security controls.\nThe inherent risks include total compromise of sensitive financial reporting data, regulatory non-compliance resulting from unauthorized data tampering, and potential operational disruption. Organizations utilizing the affected version must evaluate their physical security posture and apply vendor-supplied patches promptly to mitigate potential threats.",
  "technicalDetails": "The vulnerability affects the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. According to the CVSS 3.1 vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), the attack vector is Adjacent (AV:A), indicating that the attacker must be proximate to the target infrastructure, specifically positioned on the physical communication segment attached to the hardware hosting the vulnerable service.\nThe attack complexity is rated as High (AC:H), implying that successful exploitation requires specialized conditions, precise timing, or configuration nuances that hinder automated or opportunistic exploitation attempts. The vulnerability requires no privileges (PR:N) and no user interaction (UI:N), meaning an unauthenticated adversary on the correct network segment can initiate the attack sequence directly against the server component.\nThe attack flow begins with the threat actor establishing presence on the local physical or logical communication segment—such as the same physical local area network (LAN) or collision domain—where the Oracle Hyperion Financial Reporting server is deployed. Due to the high complexity and adjacent network requirements, the attacker likely leverages specialized interception, injection, or protocol-abuse techniques targeting unencrypted or insufficiently secured internal communication channels utilized by the server component.\nUpon successfully bypassing or abusing these communication boundaries without authentication, the payload interacts directly with the vulnerable Server component. The lack of proper input validation or session enforcement within the affected version permits the execution of unauthorized transactional operations.\nThe post-exploitation impact spans both confidentiality and integrity (C:H/I:H). The attacker achieves unauthorized read access to critical data stores and complete visibility over all Oracle Hyperion Financial Reporting accessible data. Furthermore, the attacker gains the ability to execute unauthorized write, modification, and deletion operations against critical application data, leading to potential data corruption, falsification of financial reports, and severe operational compromise."
}