Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-18T21:17:32.527Z",
  "pubdate": "2026-08-18T21:17:32.527Z",
  "executiveSummary": "A vulnerability exists in the Oracle Hyperion Financial Reporting product, specifically within the Server component, affecting version 11.2.25.0.000. This security flaw is categorized as difficult to exploit, requiring network access via the HTTP protocol and necessitating human interaction from a user other than the attacker. Despite these constraints, successful exploitation poses significant risk implications to enterprise environments relying on the affected software. An unauthenticated remote attacker who successfully executes an attack can gain unauthorized access to critical data or achieve complete read access to all data accessible within Oracle Hyperion Financial Reporting. Furthermore, the vulnerability allows unauthorized update, insert, or delete access to a subset of the accessible data, compromising both data confidentiality and integrity. The severity of the issue is underscored by a CVSS 3.1 Base Score of 5.9, reflecting high confidentiality impact and low integrity impact, with no availability disruption. Organizations utilizing the specified version must recognize that external threat actors leveraging network connectivity can bypass authorization boundaries if users are successfully manipulated into performing requisite actions during the exploitation phase.",
  "technicalDetails": "The vulnerability resides within the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000, exposed via the HTTP protocol over network interfaces. The attack vector is network-based (AV:N), meaning the vulnerable service is reachable across a network boundary without requiring local access. The attack complexity is rated as high (AC:H), indicating that successful exploitation is not trivial and requires specific preconditions, precise timing, or non-default configurations to be met by the adversary. The vulnerability does not require any prior authentication (PR:N), allowing any unauthenticated network user to initiate the attack sequence. However, a critical prerequisite for successful exploitation is user interaction (UI:R), necessitating that a third-party user performs an action—such as clicking a malicious link or interacting with a crafted web page—to facilitate the attack vector. The scope of the vulnerability is unchanged (S:U), meaning the security scope remains confined to the vulnerable application component. From a payload and impact perspective, the vulnerability results in high confidentiality impact (C:H) and low integrity impact (I:L), while availability remains unaffected (A:N). The step-by-step attack flow begins with an unauthenticated attacker crafting a malicious HTTP request or payload targeted at the Oracle Hyperion Financial Reporting Server component. Because direct exploitation requires overcoming high complexity barriers and relies on user interaction, the attacker typically employs social engineering or malicious content delivery mechanisms to induce a targeted user into initiating an authenticated session interaction or triggering a vulnerable application handler. Once the user interacts with the malicious content, the application processes the crafted HTTP input, leading to a breakdown in access control enforcement. This allows the attacker to leverage the user context or application flaw to read critical and sensitive financial datasets or execute unauthorized data modification operations, specifically inserting, updating, or deleting restricted information subsets within the Oracle Hyperion Financial Reporting database environment."
}