Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 2.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.5",
  "pubDate": "2026-08-18T21:17:49.700Z",
  "pubdate": "2026-08-18T21:17:49.700Z",
  "executiveSummary": "An integrity vulnerability exists within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. This security flaw presents a low-severity risk with a CVSS 3.1 Base Score of 2.5, specifically impacting data integrity without affecting confidentiality or availability. The vulnerability is classified as difficult to exploit and requires an unauthenticated attacker to have prior logon access to the underlying infrastructure where Oracle Hyperion Financial Management executes. Successful exploitation mandates human interaction from a third party other than the attacker. The primary impact of a successful attack is limited to unauthorized update, insert, or delete access to a subset of data accessible by Oracle Hyperion Financial Management. Organizations utilizing the affected version face potential unauthorized data modification risks if attackers successfully navigate the prerequisite local infrastructure access and social engineering requirements.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. From an architectural perspective, the attack vector (AV:L) requires the threat actor to have local access to the target infrastructure hosting the application runtime environment. The attack complexity (AC:H) is evaluated as high, indicating that successful exploitation relies on intricate conditions, precise timing, or specific environmental configurations that are difficult to orchestrate consistently.\nRegarding authentication and privileges, the vulnerability requires no direct application-level authentication (PR:N) from the attacker prior to establishing the local infrastructure presence, but the attack flow is heavily dependent on user interaction (UI:R). This implies that the threat actor must deceive or coerce another authenticated user or system administrator into performing a specific action that triggers the flaw. The scope (S:U) remains unchanged, meaning the vulnerability does not cross security boundaries to impact adjacent components or systems beyond the immediate Oracle Hyperion Financial Management context.\nThe step-by-step attack flow begins with the unauthenticated threat actor gaining logon access to the infrastructure hosting Oracle Hyperion Financial Management. Subsequently, the attacker leverages social engineering or induced human interaction from a privileged or interacting user to trigger the vulnerable code path within the Security component. Once the interaction occurs, the payload or exploited sequence bypasses intended access controls, granting the attacker the capability to execute unauthorized update, insert, or delete operations against vulnerable data repositories managed or accessed by the application. The confidentiality impact remains none (C:N), and availability is unaffected (A:N), limiting the post-exploitation impact strictly to integrity degradation of accessible data."
}