Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:17:32.387Z",
  "pubdate": "2026-08-18T21:17:32.387Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Server component of the Oracle Hyperion Financial Reporting product, specifically affecting version 11.2.25.0.000. This security flaw allows an unauthenticated remote attacker with network access via the HTTP protocol to compromise the targeted system without requiring user interaction.\nSuccessful exploitation of this vulnerability results in unauthorized data manipulation capabilities, granting attackers the ability to execute unauthorized updates, insertions, and deletions on a subset of data accessible to Oracle Hyperion Financial Reporting. Additionally, the vulnerability allows unauthorized read access to specific subsets of sensitive application data, compromising both data confidentiality and data integrity.\nFrom a risk perspective, the absence of authentication requirements combined with network accessibility significantly lowers the barrier to entry for malicious actors. Attackers can leverage standard HTTP requests to interact with the vulnerable Server component, bypassing access controls to interact with sensitive financial and operational records. The high CVSS 3.1 base score of 6.5 underscores the severity of exposing enterprise reporting systems directly to unauthenticated network traffic, necessitating immediate defensive prioritization and remediation actions.",
  "technicalDetails": "The vulnerability resides in the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. The root cause stems from inadequate input validation, authorization checks, or access control enforcement within the HTTP request handling logic exposed by the server. This architectural flaw permits external entities to invoke functionality or access endpoints that should be restricted to authenticated administrative or user contexts.\nRegarding exploitation requirements, the vulnerability features a network attack vector (AV:N), indicating that it can be exploited remotely over a network connection without physical or local access. The attack complexity is rated as low (AC:L), meaning the exploitation process does not require specialized conditions, race conditions, or complex configurations by the attacker. Furthermore, the vulnerability requires zero privileges (PR:N) and zero user interaction (UI:N), allowing automated scripts or unauthenticated adversaries to directly issue crafted HTTP requests to the target application.\nThe attack flow proceeds as follows: an unauthenticated attacker leverages network connectivity to target the HTTP endpoints exposed by the Oracle Hyperion Financial Reporting Server component. By transmitting specifically crafted HTTP requests containing malicious payloads or unauthorized parameters, the attacker bypasses authentication mechanisms. The vulnerable server processes these incoming requests without properly verifying the identity or authorization level of the requester.\nOnce the request is processed, the server executes the operations requested by the unauthenticated user. Depending on the crafted payload, this leads to unauthorized read access, allowing the retrieval of sensitive subsets of data managed by Oracle Hyperion Financial Reporting. Simultaneously, the payload can trigger unauthorized data modification pathways, resulting in the unauthorized update, insert, or delete actions against accessible data repositories. The scope remains unchanged (S:U), meaning the impact is confined to the vulnerable component itself without directly compromising broader underlying host operating system resources beyond the application's data domain."
}