Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 4.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.0",
  "pubDate": "2026-08-18T21:17:49.470Z",
  "pubdate": "2026-08-18T21:17:49.470Z",
  "executiveSummary": "An information disclosure vulnerability has been identified within the Security component of the Oracle Hyperion Financial Management product. This vulnerability affects version 11.2.25.0.000 and presents a risk to the confidentiality of sensitive enterprise financial data stored or processed within the application.\nThe vulnerability allows an unauthenticated attacker who has obtained local logon access to the underlying infrastructure hosting the Oracle Hyperion Financial Management environment to execute unauthorized read operations against a subset of accessible application data. The attack vector is localized, requiring physical or remote interactive terminal access to the host operating system rather than direct network exposure to the application service itself.\nFrom a risk perspective, successful exploitation compromises the confidentiality pillar of the CIA triad by exposing restricted data subsets to unauthorized entities sharing the infrastructure. While the attacker requires prior logon capabilities to the host operating system, the lack of authentication requirements at the application security layer facilitates straightforward exploitation once local access is achieved.\nThe CVSS 3.1 base score is 4.0, reflecting localized attack vectors, low attack complexity, no required privileges or user interaction, and an impact strictly limited to confidentiality without affecting system integrity or availability.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from inadequate access controls or improper isolation within the local execution environment, which permits local processes or users with infrastructure logon rights to query or access sensitive data repositories managed by the application.\nThe attack vector is categorized as Local (AV:L), meaning the threat actor must already possess execution capabilities on the host infrastructure where Oracle Hyperion Financial Management is deployed. The attack complexity is low (AC:L), requiring no advanced race conditions, memory corruption techniques, or complex cryptographic manipulation. Furthermore, the vulnerability requires no privileges (PR:N) at the application or component layer, and no user interaction (UI:N) is necessary to trigger the exposure.\nThe attack flow proceeds as follows: First, the attacker establishes a valid logon session on the underlying host operating system via administrative interfaces, terminal services, or secondary local privilege escalation vectors. Second, leveraging the local environment access, the attacker interacts directly with the vulnerable Security component or local data stores utilized by Oracle Hyperion Financial Management. Third, due to insufficient local boundary enforcement or overly permissive file system and memory access controls, the attacker bypasses intended application-layer authorization boundaries. Finally, the attacker extracts unauthorized read access to a subset of sensitive Oracle Hyperion Financial Management data.\nThe impact is strictly confined to confidentiality (C:L) with no scope change (S:U). Integrity (I:N) and availability (A:N) metrics remain unaffected, as the vulnerability does not support data modification, system disruption, or remote code execution."
}