Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:17:40.830Z",
  "pubdate": "2026-08-18T21:17:40.830Z",
  "executiveSummary": "A security vulnerability has been identified within the Oracle Hyperion Financial Management product, specifically affecting the Security component in version 11.2.25.0.000. This vulnerability allows an authenticated attacker with high privileges and network access via the HTTP protocol to compromise the affected system. Successful exploitation of this flaw leads to severe impacts on confidentiality and availability, resulting in unauthorized access to critical or fully accessible data, as well as the ability to cause a hang or frequently repeatable crash, culminating in a complete denial of service (DoS) condition. The vulnerability is easily exploitable over the network, requiring no user interaction, but necessitates high-level privileges within the application context. The CVSS 3.1 base score for this vulnerability is 6.5, reflecting significant risks to data confidentiality and service availability. Organizations utilizing the affected version should implement appropriate security controls and apply vendor-supplied patches or updates as soon as they become available to mitigate potential security exposure.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. It is exposed via the network over the HTTP protocol, allowing remote interaction with the vulnerable service endpoints. Exploitation of this flaw requires the attacker to possess high privileges within the application environment, meaning unauthenticated users or low-privileged accounts cannot directly leverage this specific vector. The attack flow involves a malicious actor crafting specialized HTTP requests directed at the vulnerable Security component. Because the component improperly validates or processes these high-privilege inputs, the malicious payload triggers anomalous internal behavior. This behavior manifests in two primary ways: unauthorized exposure of sensitive data managed by Oracle Hyperion Financial Management, leading to a complete compromise of data confidentiality, and resource exhaustion or application instability that causes the service to hang or crash repeatedly, resulting in a complete denial of service (DoS). The vector parameters documented in the CVSS 3.1 scoring (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H) indicate Network attack vector (AV:N), Low attack complexity (AC:L), High privileges required (PR:H), No user interaction required (UI:N), Unchanged scope (S:U), High confidentiality impact (C:H), No integrity impact (I:N), and High availability impact (A:H). The combination of low attack complexity and high impact on both confidentiality and availability underscores the necessity for strict administrative access controls and network segmentation to limit exposure of the management interface."
}