Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:37.167Z",
  "pubdate": "2026-08-18T21:17:37.167Z",
  "executiveSummary": "A vulnerability exists within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000, allowing remote unauthenticated attackers to compromise the system.\nThe flaw allows unauthorized actors with network access via HTTP to bypass security controls and attain unauthorized access to critical data.\nThe security impact is strictly limited to confidentiality, resulting in potential exposure of all Oracle Hyperion Financial Management accessible data.\nThe vulnerability is classified as easily exploitable, requiring no user interaction, low attack complexity, and no prior privileges.\nGiven the severity and remote network vector, organizations utilizing the affected version face significant risk of sensitive financial data exposure and unauthorized information disclosure.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000.\nThe attack vector is network-based, allowing threat actors to interact directly with the application layer over the HTTP protocol.\nExploitation requires zero privileges and no user interaction, categorized under a low attack complexity metric.\nThe root cause permits unauthenticated session handling or flawed access control enforcement within the Security component, enabling remote bypass of authentication mechanisms.\nDuring an attack flow, a malicious actor submits crafted HTTP requests targeting the vulnerable Security component endpoints.\nBecause the application fails to adequately validate the authenticity or authorization of the incoming requests, the security boundary is successfully bypassed.\nUpon successful exploitation, the attacker gains unauthorized read access to critical enterprise data repositories managed by Oracle Hyperion Financial Management.\nThe resulting impact is restricted to the confidentiality vector, yielding unauthorized disclosure or complete access to all data accessible within the scope of the affected application instance, while integrity and availability remain unimpacted."
}