Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:36.620Z",
  "pubdate": "2026-08-18T21:17:36.620Z",
  "executiveSummary": "A vulnerability exists within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000, presenting significant operational risks to enterprise deployments. This security flaw is categorized as an easily exploitable vulnerability that allows a network-adjacent attacker with low privileges to leverage SQL vectors against the targeted system. Successful exploitation of this vulnerability grants the adversary complete administrative control, leading to the full takeover of the Oracle Hyperion Financial Management product. The severity of this issue is underscored by a CVSS 3.1 Base Score of 8.8, reflecting high impacts across all three components of the CIA triad: Confidentiality, Integrity, and Availability. The attack vector is network-accessible with low attack complexity, requiring no user interaction and low privileges. Consequently, unauthorized entities possessing minimal authentication credentials can compromise core financial systems, severely undermining organizational data security, financial reporting integrity, and continuous business operations. Immediate remediation is critical to prevent total system compromise and unauthorized data access.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000, specifically within database interaction routines that handle SQL queries. The root cause stems from insufficient input sanitization and parameterized query implementation, allowing specially crafted SQL payloads to be injected and executed within the application context. Exploitation occurs via network access, where an attacker with low privileges submits malicious SQL queries through application interfaces or underlying database communication channels. Because the application fails to adequately validate or restrict user-supplied input before database execution, the injected SQL commands are processed directly by the database management system. The step-by-step attack flow begins with the low-privileged attacker identifying an input vector or interface exposed via the network that communicates directly with the vulnerable Security component. The attacker then crafts a specialized payload designed to manipulate backend database logic, potentially escalating privileges, extracting sensitive data, or executing administrative commands. Once the payload is successfully processed, the attacker achieves arbitrary command execution or privilege escalation within the database and application tiers. The post-exploitation impact includes complete administrative takeover of Oracle Hyperion Financial Management, allowing the adversary to read, modify, or delete sensitive financial data, manipulate system configurations, and disrupt availability. The attack requires no user interaction, features a low attack complexity, and relies solely on network connectivity and low-level user credentials to execute successfully against the affected version."
}