Description

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-18T21:17:33.103Z",
  "pubdate": "2026-08-18T21:17:33.103Z",
  "executiveSummary": "An unauthenticated or low-privileged network-based vulnerability affects the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. Classified as a difficult-to-exploit security flaw, this vulnerability allows an attacker with low privileges and network access via the HTTP protocol to compromise the confidentiality and integrity of the targeted application. Successful exploitation of this vulnerability does not impact system availability, but it grants unauthorized read, update, insert, and delete access to a subset of data accessible within Oracle Hyperion Financial Reporting. The vulnerability carries a CVSS 3.1 Base Score of 4.2, reflecting moderate risks primarily centered around unauthorized data manipulation and information disclosure. The attack vector is network-based, requiring high attack complexity, low-level privileges, and no user interaction, making standard perimeter defenses and robust access controls critical for mitigating exposure.",
  "technicalDetails": "The vulnerability resides within the Server component of Oracle Hyperion Financial Reporting version 11.2.25.0.000. The root cause stems from insufficient authorization checks or improper input validation handling within the application logic governing data transactions over HTTP. Because the vulnerability requires high attack complexity, successful exploitation necessitates specific timing, race conditions, or environmental configurations that make reproducible attacks difficult to execute consistently.\nThe attack flow begins when a low-privileged authenticated adversary leverages network access via HTTP to interact with the vulnerable Server component. The attacker crafts specialized requests designed to bypass internal access control lists or input filters implemented within the reporting framework. Due to the lack of granular validation and authorization enforcement on specific functional endpoints, the server processes the incoming requests and executes unauthorized database or data structure operations.\nUpon successful payload delivery and processing, the attacker gains unauthorized capabilities including the ability to read sensitive information as well as perform insert, update, or delete operations on accessible data subsets within Oracle Hyperion Financial Reporting. The post-exploitation impact is strictly confined to data integrity and confidentiality degradation, as the CVSS metrics explicitly indicate zero impact on system availability. Authentication is required at a low privilege level, meaning an adversary must possess valid credentials within the system scope before initiating the attack sequence over the network interface."
}