Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:17:38.370Z",
  "pubdate": "2026-08-18T21:17:38.370Z",
  "executiveSummary": "A security vulnerability has been identified within the Oracle Hyperion Financial Management product, specifically affecting the Security component in version 11.2.25.0.000. This vulnerability allows an authenticated attacker with low privileges and network access via the HTTP protocol to compromise the affected system and achieve unauthorized data access.\nThe flaw carries a CVSS 3.1 Base Score of 6.5, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating that the impact is strictly focused on confidentiality without affecting system integrity or availability. The attack vector is network-based, exploitation is characterized as easy, and no user interaction is required.\nSuccessful exploitation of this vulnerability can lead to unauthorized access to critical financial and corporate data, or even complete access to all data accessible by the Oracle Hyperion Financial Management application. Organizations utilizing the affected version face significant compliance and data exposure risks if the vulnerability remains unpatched or unmitigated.\nDue to the low privilege requirements and remote network exploitability, defensive postures must prioritize securing HTTP endpoints and implementing strict access controls surrounding the vulnerable Security component.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. It enables unauthorized retrieval of sensitive data by bypassing existing authorization mechanisms or abusing logical flaws in session or permission validation routines.\nThe attack vector is network-based (AV:N), allowing threat actors to target the application remotely over the HTTP protocol. The complexity of the attack is low (AC:L), meaning no specialized conditions or race conditions are required for successful exploitation. Furthermore, the attack does not require user interaction (UI:N) and maintains a unchanged security scope (S:U).\nAn attacker must possess low privileges (PR:L), implying that valid user credentials with minimal access rights are required to initiate the attack sequence. Upon authentication, the attacker crafts malicious HTTP requests targeted at the vulnerable Security component endpoints.\nStep-by-step, the exploitation flow proceeds as follows: First, the low-privileged attacker establishes an HTTP connection to the exposed Oracle Hyperion Financial Management interface. Second, the attacker submits crafted requests designed to probe or bypass the authorization controls enforced by the Security component. Third, due to inadequate validation or improper access checks within the vulnerable component, the application fails to restrict the request appropriately. Finally, the server processes the request and returns critical data to the unauthorized user, resulting in a direct breach of confidentiality.\nThe post-exploitation impact is limited to the confidentiality vector (C:H), resulting in the exposure of critical data or complete access to all data repositories accessible within the Oracle Hyperion Financial Management environment. Integrity (I:N) and Availability (A:N) vectors remain unaffected, meaning data modification, deletion, and denial of service conditions are not direct outcomes of this specific vulnerability."
}