Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:17:37.703Z",
  "pubdate": "2026-08-18T21:17:37.703Z",
  "executiveSummary": "An easily exploitable security vulnerability affects the Oracle Hyperion Financial Management product within the Security component, specifically targeting version 11.2.25.0.000. This flaw allows a remote attacker with low privileges and network access via HTTP to compromise the confidentiality of the application.\nSuccessful exploitation of this vulnerability directly impacts data confidentiality, granting unauthorized access to critical data or complete read access to all information accessible within Oracle Hyperion Financial Management. The attack requires no user interaction and can be executed remotely over the network, lowering the overall barrier to entry for malicious actors.\nThe risk implication is severe for organizations utilizing the affected financial management system, as unauthorized exposure of sensitive corporate financial data can lead to regulatory non-compliance, loss of proprietary business intelligence, and severe reputational damage. The vulnerability exhibits a CVSS 3.1 Base Score of 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating that integrity and availability remain unaffected while confidentiality is completely compromised.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The underlying root cause stems from insufficient authorization enforcement and access control validation within HTTP-based request handlers, allowing authenticated users to bypass intended security boundaries and query data objects outside their authorized scope.\nThe attack vector is network-based (AV:N), requiring the adversary to possess low privileges (PR:L) within the application domain. The attack complexity is rated as low (AC:L), meaning no specialized race conditions or complex exploitation chains are required. Furthermore, the vulnerability requires no user interaction (UI:N), and the scope remains unchanged (S:U).\nThe step-by-step attack flow proceeds as follows: First, the low-privileged attacker establishes a standard HTTP session with the vulnerable Oracle Hyperion Financial Management instance, authenticating with baseline credentials that grant minimal access rights. Second, the attacker crafts malicious HTTP requests targeting the vulnerable Security component endpoints, manipulating parameters or URI structures designed to enforce access control checks. Third, due to inadequate validation logic in the affected component, the application fails to verify whether the authenticated user possesses the requisite administrative or data-owner privileges for the requested resources. Fourth, the server processes the unauthorized request and returns the sensitive financial records within the HTTP response payload.\nPost-exploitation impact is strictly localized to confidentiality degradation (C:H), where the attacker successfully harvests critical corporate financial data, sensitive ledger entries, and other proprietary operational information stored and processed by Oracle Hyperion Financial Management without triggering integrity alterations or denial-of-service conditions."
}