Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:37.030Z",
  "pubdate": "2026-08-18T21:17:37.030Z",
  "executiveSummary": "A vulnerability affecting the Oracle Hyperion Financial Management product within the Security component allows unauthorized compromise of the target system. This remotely exploitable security flaw poses significant risks to enterprise financial infrastructure by granting unauthorized actors total control over the affected application.\nThe vulnerability targets version 11.2.25.0.000 of Oracle Hyperion Financial Management. Successful exploitation requires network access and relies on SQL interaction, permitting a low-privileged authenticated attacker to execute arbitrary database-level operations or leverage injection vectors to compromise the application. The severity of the flaw is reflected in its CVSS 3.1 Base Score of 8.8, indicating high impacts across confidentiality, integrity, and availability metrics.\nThe risk implications include complete system takeover, unauthorized access to sensitive financial data, modification or deletion of critical records, and disruption of core business operations. Mitigation of this risk necessitates applying vendor-supplied updates or patches specific to the affected version, restricting network exposure, and enforcing strict principle of least privilege principles for database and application users.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from improper neutralization of data supplied to SQL queries or inadequate input validation within database-interacting functions managed by the Security subsystem. This enables an authenticated adversary with low privileges to supply crafted SQL payloads via network protocols.\nThe attack vector is network-based (AV:N), requiring low attack complexity (AC:L) and low privileges (PR:L), with no user interaction (UI:N) required. The scope is unmodified (S:U), meaning the impact remains within the boundaries of the vulnerable Oracle Hyperion Financial Management application context.\nThe step-by-step attack flow proceeds as follows: First, the attacker authenticates to the network interface of Oracle Hyperion Financial Management using low-privileged credentials. Second, the attacker formulates a malicious payload delivered via SQL vectors targeting the vulnerable Security component. Third, the application improperly processes the input, executing unauthorized database commands or SQL statements due to insufficient sanitization.\nPost-exploitation impact includes full system takeover of Oracle Hyperion Financial Management. An attacker achieving successful exploitation can compromise the confidentiality, integrity, and availability of the system (C:H/I:H/A:H), potentially extracting sensitive financial data, altering transactional records, or disrupting application availability."
}