Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:17:37.567Z",
  "pubdate": "2026-08-18T21:17:37.567Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Security component of Oracle Hyperion Financial Management, specifically affecting version 11.2.25.0.000. This security flaw allows a remote, authenticated attacker with low privileges to leverage network access via HTTP to compromise the confidentiality of the application.\nSuccessful exploitation of this vulnerability results in unauthorized access to critical data or complete access to all data accessible within Oracle Hyperion Financial Management. The attack vector is network-based, requiring no user interaction and exploiting low complexity parameters, leading to a CVSS 3.1 Base Score of 6.5 with high confidentiality impacts.\nThe risk implications are significant for organizations utilizing the affected Oracle Hyperion Financial Management platform, as compromise of financial and sensitive operational data can lead to regulatory non-compliance, severe reputational damage, and loss of proprietary business intelligence. Threat actors possessing standard low-privileged user credentials can abuse this flaw to bypass intended access control mechanisms and exfiltrate restricted data assets without requiring elevated administrative privileges.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from insufficient authorization enforcement and access control validation within HTTP request handling routines, allowing authenticated users to transcend their intended security boundaries and access unauthorized data resources.\nThe attack vector is network-based (AV:N), requiring the attacker to possess low privileges (PR:L) and valid authentication credentials to interact with the target application over the HTTP protocol. The exploitation complexity is rated as low (AC:L), and the attack requires zero user interaction (UI:N), meaning the request can be scripted and executed directly against the vulnerable endpoint by an attacker.\nThe step-by-step attack flow involves the following phases: First, the low-privileged attacker establishes a network connection to the Oracle Hyperion Financial Management application via HTTP. Second, the attacker crafts specialized HTTP requests directed at the vulnerable Security component endpoints, manipulating parameters or identifiers associated with data access permissions. Third, due to inadequate server-side validation of the user's session context against the requested data objects, the application fails to enforce proper authorization checks. Finally, the server processes the request and returns the unauthorized data payload to the attacker.\nThe post-exploitation impact is strictly confined to confidentiality (C:H), resulting in unauthorized disclosure of critical enterprise data or complete access to all data repositories accessible to the Oracle Hyperion Financial Management instance. Integrity (I:N) and Availability (A:N) impacts are none, as the vulnerability does not inherently permit data modification, destruction, or denial of service conditions through this specific vector."
}