Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-18T21:17:39.060Z",
  "pubdate": "2026-08-18T21:17:39.060Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Security component of the Oracle Hyperion Financial Management product, specifically affecting version 11.2.25.0.000. This security flaw enables a low-privileged authenticated attacker with local logon access to the underlying infrastructure to compromise the application and achieve unauthorized access to sensitive financial repositories.\nThe vulnerability carries a CVSS 3.1 Base Score of 5.5, with impacts strictly restricted to confidentiality (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Successful exploitation does not require user interaction and can result in the complete disclosure or unauthorized retrieval of all data accessible to Oracle Hyperion Financial Management. The primary risk involves the exposure of critical enterprise financial data to unauthorized internal actors due to insufficient access controls or insecure configurations within the security subsystem.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from inadequate enforcement of access controls and insufficient authorization checks within the infrastructure handling security operations and data access requests. Because the flaw can be leveraged locally, it bypasses perimeter security defenses and exploits internal trust relationships established on the host system.\nExploitation requires a low-privileged attacker to have valid logon access to the host infrastructure where Oracle Hyperion Financial Management executes. The attack vector is local (AV:L), with low attack complexity (AC:L) and low privilege requirements (PR:L). No user interaction (UI:N) is mandated for successful execution. The scope is unmodified (S:U).\nDuring the attack flow, the malicious actor leverages their low-privileged local session to interact directly with the vulnerable Security component or associated local execution vectors. Due to flawed permission validation and access restriction mechanisms, the attacker is able to elevate their operational context relative to the application's data repositories or bypass intended logical boundaries. This allows them to issue unauthorized queries or directly read restricted memory spaces and file stores managed by the application.\nThe post-exploitation impact is characterized by a complete compromise of data confidentiality (C:H). The attacker gains unauthorized read access to critical application data or total access to all information structures accessible via Oracle Hyperion Financial Management, resulting in severe data exposure without affecting system integrity or availability."
}