Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:38.507Z",
  "pubdate": "2026-08-18T21:17:38.507Z",
  "executiveSummary": "An unauthenticated, network-exploitable vulnerability exists within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. This security flaw allows remote attackers with network access via HTTP to compromise the affected system without requiring user interaction or prior authentication. Successful exploitation of this vulnerability directly impacts data confidentiality, leading to unauthorized access to critical financial information or complete access to all data accessible by Oracle Hyperion Financial Management. The vulnerability carries a CVSS 3.1 Base Score of 7.5, reflecting its severe impact on data exposure while maintaining a low attack complexity due to the absence of required privileges.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000, specifically handling network-based requests over the HTTP protocol. The root cause stems from inadequate access controls and authentication enforcement within the security subsystem, permitting external entities to bypass authentication checks.\nAttackers initiate the attack vector via the network layer using standard HTTP requests directed at vulnerable endpoints exposed by the Oracle Hyperion Financial Management application. Because the vulnerability requires no privileges (PR:N) and no user interaction (UI:N), an unauthenticated remote adversary can directly interact with the exposed component.\nThe attack flow proceeds as follows: First, the adversary establishes network connectivity to the target Oracle Hyperion Financial Management server over HTTP. Second, the attacker issues specially crafted requests designed to target the insecure Security component. Third, due to insufficient input validation and access validation mechanisms, the component fails to reject the unauthorized request. Finally, the system processes the request and discloses sensitive data back to the attacker.\nThe resulting impact is strictly concentrated on confidentiality (C:H), yielding unauthorized access to critical data or complete access to all information accessible within the scope of the Oracle Hyperion Financial Management application. Integrity and availability impacts remain unaffected (I:N, A:N)."
}