Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:32.247Z",
  "pubdate": "2026-08-18T21:17:32.247Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. This security flaw allows a low-privileged network attacker to compromise the target application via the HTTP protocol without requiring user interaction.\nSuccessful exploitation of this vulnerability results in a complete takeover of Oracle Hyperion Financial Reporting, impacting confidentiality, integrity, and availability with a CVSS 3.1 Base Score of 8.8.\nThe risk implications are severe, as unauthorized actors with minimal network access can achieve full administrative or system-level control over the reporting server, leading to potential data exposure, data tampering, and service disruption.\nMitigation requires applying vendor-supplied updates or implementing strict network access controls to restrict unauthorized HTTP requests to the vulnerable Server component.",
  "technicalDetails": "The vulnerability resides within the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. It is exposed over the network via the HTTP protocol, making it accessible to any entity capable of routing traffic to the application interface.\nExploitation requires low privileges, meaning the attacker must authenticate with minimal access rights before initiating the attack sequence. However, no user interaction is necessary to successfully execute the exploit payload.\nThe attack flow begins when the authenticated low-privileged attacker sends a maliciously crafted HTTP request targeting the vulnerable Server component of Oracle Hyperion Financial Reporting. Due to insufficient input validation, deserialization flaws, or improper authorization checks within the affected codebase, the application processes the malicious payload.\nThe payload compromises the execution flow of the application, allowing the attacker to bypass security controls and escalate privileges. Post-exploitation impact includes complete system takeover, granting the attacker the ability to read, modify, or delete sensitive financial data, manipulate application logic, and disrupt availability.\nThe CVSS 3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack vector is Network (AV:N), attack complexity is Low (AC:L), privileges required are Low (PR:L), user interaction is None (UI:N), scope is Unchanged (S:U), and impacts to confidentiality, integrity, and availability are all High (C:H/I:H/A:H)."
}