Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:17:37.437Z",
  "pubdate": "2026-08-18T21:17:37.437Z",
  "executiveSummary": "A security vulnerability has been identified within the Oracle Hyperion Financial Management product, specifically affecting the Security component in version 11.2.25.0.000. This vulnerability allows an authenticated attacker with low privileges and network access via HTTP to compromise the confidentiality of the application.\nThe flaw presents significant risk implications for enterprise environments by potentially exposing sensitive financial records and proprietary data. Successful exploitation requires low privileges and no user interaction, making it accessible to internal actors or compromised accounts with standard authorization levels.\nThe primary impact is strictly limited to confidentiality, enabling unauthorized access to critical data or complete access to all data accessible within Oracle Hyperion Financial Management. The vulnerability carries a CVSS 3.1 Base Score of 6.5, with a vector of (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from insufficient authorization checks or flawed access control enforcement within the affected module, allowing users with low privileges to query or retrieve data outside their designated authorization boundary.\nAttackers targeting this vulnerability must possess network connectivity to the application via the HTTP protocol and maintain valid low-privileged credentials. The attack complexity is low, requiring no specialized user interaction or complex exploitation chains.\nDuring the attack flow, the adversary crafts malicious HTTP requests directed at the vulnerable Security component endpoints. Because the underlying access controls fail to properly validate the user's privilege level against the requested resource context, the application processes the request and returns sensitive data to the unauthorized session.\nThe post-exploitation impact is focused exclusively on confidentiality degradation. An attacker can systematically harvest critical data or achieve complete visibility over all data accessible within the scope of the Oracle Hyperion Financial Management instance, potentially leading to severe regulatory and business intelligence losses without impacting system integrity or availability."
}