Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-18T21:17:40.697Z",
  "pubdate": "2026-08-18T21:17:40.697Z",
  "executiveSummary": "A vulnerability has been identified within the Security component of Oracle Hyperion Financial Management, specifically affecting version 11.2.25.0.000. This security flaw is classified as a difficult-to-exploit vulnerability that allows an unauthenticated attacker to compromise the application over a network via the HTTP protocol.\nSuccessful exploitation of this vulnerability results in unauthorized read access to a subset of data accessible within Oracle Hyperion Financial Management, leading to a direct impact on data confidentiality.\nThe vulnerability carries a CVSS 3.1 Base Score of 3.7 with the vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). The attack vector is network-based (AV:N), requiring high attack complexity (AC:H), no privileges (PR:N), and no user interaction (UI:N). The scope remains unchanged (S:U), with impacts strictly limited to low confidentiality (C:L) and no integrity or availability disruption.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from improper access controls or insufficient validation mechanisms within the HTTP-based request processing pipeline handled by the vulnerable subsystem.\nExploitation of this flaw requires network access via the HTTP protocol. Although the attacker does not require prior authentication or user interaction, the exploitation mechanism is categorized as having high complexity. This indicates that successful execution likely requires precise timing, specific environmental conditions, or targeted reconnaissance to bypass existing defensive checks or leverage subtle logic flaws in the security component.\nThe step-by-step attack flow involves an unauthenticated remote threat actor crafting specialized HTTP requests directed at the exposed Oracle Hyperion Financial Management endpoints. Due to the high attack complexity, the actor must carefully formulate the payload to interact with the vulnerable Security component. Upon reception, the component fails to properly enforce authorization boundaries, incorrectly granting the request.\nPost-exploitation impact is strictly confined to confidentiality degradation. The attacker gains unauthorized read access to a subset of sensitive enterprise financial data accessible to the application, potentially exposing proprietary business intelligence, financial records, or operational metrics without triggering integrity or availability failures."
}