Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-18T21:17:48.747Z",
  "pubdate": "2026-08-18T21:17:48.747Z",
  "executiveSummary": "An easily exploitable vulnerability affects the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. This security flaw allows unauthenticated threat actors with network access via the HTTP protocol to compromise the targeted application. Successful exploitation of this vulnerability leads to severe security repercussions, specifically granting unauthorized access to critical data or complete access to all data accessible within Oracle Hyperion Financial Management, alongside an unauthorized ability to induce a partial denial of service condition affecting the application.\nThe CVSS 3.1 base score for this vulnerability is assessed at 8.2, reflecting high confidentiality impacts and low availability impacts. The attack vector is strictly network-based with low attack complexity, requiring no privileges and no user interaction, maintaining an unchanged scope. Due to these attributes, the risk implications are substantial, enabling remote unauthenticated adversaries to extract sensitive financial data and disrupt operational availability.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from improper access controls or insecure handling of authentication and authorization boundaries within the network-exposed HTTP interface, which fails to adequately validate unauthenticated requests before processing them.\nThe attack vector is network-based (AV:N), utilizing the HTTP protocol to interact with the vulnerable application endpoints. Because the attack complexity is low (AC:L), an adversary does not require specialized conditions or advanced configurations to execute the exploit. Furthermore, the vulnerability requires zero privileges (PR:N) and zero user interaction (UI:N), meaning an unauthenticated attacker can initiate malicious HTTP requests directly against the target system without prior access credentials or victim engagement.\nThe step-by-step attack flow involves the remote attacker routing crafted HTTP requests over the network to the vulnerable Security component of Oracle Hyperion Financial Management. Upon receiving these malicious inputs, the affected component fails to enforce proper authentication checks, allowing the payload to bypass security controls. This grants the attacker unauthorized read access to critical application data or complete access to all data accessible by Oracle Hyperion Financial Management, fulfilling the high confidentiality impact.\nConcurrently, the payload execution or subsequent request handling strains system resources or disrupts core processing logic, resulting in a partial denial of service (partial DoS) condition that impairs the operational availability of Oracle Hyperion Financial Management, corresponding to the low availability impact defined in the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L)."
}