Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:17:48.990Z",
  "pubdate": "2026-08-18T21:17:48.990Z",
  "executiveSummary": "An unauthenticated information disclosure vulnerability affects the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. This security flaw allows remote attackers with network access via the HTTP protocol to interact with the application and compromise confidentiality without requiring user interaction or prior authentication.\nSuccessful exploitation of this vulnerability results in unauthorized read access to a specific subset of data accessible within Oracle Hyperion Financial Management. Given that the affected product handles sensitive financial consolidation and reporting data, unauthorized exposure of this subset poses significant compliance and data privacy risks.\nThe vulnerability is classified under CVSS 3.1 with a base score of 5.3, reflecting purely confidentiality impacts with no integrity or availability disruption. The attack vector is strictly network-based, featuring low attack complexity and zero privilege requirements, making it easily exploitable by any external threat actor capable of reaching the vulnerable HTTP interface.\nOrganizations running the affected version must implement immediate compensating controls and apply official vendor patches as supplied by Oracle to eliminate the underlying flaw and secure sensitive financial data against unauthorized extraction.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. This component is responsible for managing authentication, authorization, and access control boundaries across the enterprise performance management environment.\nThe root cause stems from improper access control enforcement within the HTTP request handling logic of the affected Security module. Specifically, certain endpoints or functional routines fail to adequately validate whether an incoming HTTP request originates from an authenticated and authorized session before returning sensitive data.\nExploitation is executed remotely over the network via standard HTTP requests sent directly to the vulnerable application server interface. Because the vulnerability requires no privileges, user interaction, or prior authentication, an attacker can directly target the exposed HTTP endpoints without establishing a valid user context.\nThe attack flow proceeds as follows: First, the unauthenticated attacker probes or directly targets known HTTP endpoints associated with the Oracle Hyperion Financial Management Security component. Second, the attacker crafts a malicious HTTP request designed to bypass or query the improperly secured function. Third, the vulnerable component processes the request without enforcing mandatory authorization checks. Finally, the application returns a response containing the sensitive data subset, leading to unauthorized information disclosure.\nThe payload behavior is strictly passive from an execution standpoint, focusing exclusively on data retrieval rather than remote code execution or system modification. Consequently, post-exploitation impact is bound to confidentiality degradation, exposing corporate financial metrics, configuration parameters, or user metadata accessible to the affected security context."
}