Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-18T21:17:49.927Z",
  "pubdate": "2026-08-18T21:17:49.927Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Security component of the Oracle Hyperion Financial Management product, specifically affecting version 11.2.25.0.000. This critical flaw allows unauthenticated remote attackers with network access via TLS to compromise the affected system without requiring user interaction.\nDue to architectural vulnerabilities resulting in a significant scope change, successful exploitation extends beyond the primary application, impacting additional secondary products and compromising the entire security boundary. The attack vector enables unauthorized threat actors to execute complete read, create, deletion, and modification operations against critical enterprise data and all accessible Oracle Hyperion Financial Management datasets.\nCarrying a maximum CVSS 3.1 Base Score of 10.0 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, this vulnerability presents severe risk implications for enterprise confidentiality and data integrity. Remediation requires immediate attention from system administrators through the application of official vendor patches and strict network segmentation controls.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The flaw stems from insufficient input validation, authorization enforcement, or cryptographic boundary handling within the TLS-secured network communication channels exposed by the application layer.\nAttackers initiate the exploitation process over the network by establishing a TLS connection to the vulnerable Oracle Hyperion Financial Management service. Because the vulnerability requires low attack complexity (AC:L), no prior authentication (PR:N), and no user interaction (UI:N), an unauthenticated remote adversary can seamlessly interact with the vulnerable Security component.\nUpon establishing network connectivity, the attacker transmits a maliciously crafted payload designed to bypass authentication and access controls enforced by the Security component. Due to the inherent scope change (S:C) characteristic of this vulnerability, successful execution transcends the initial trust boundary of the Oracle Hyperion Financial Management application, granting the adversary unauthorized control or visibility over interacting secondary products and peripheral systems.\nPost-exploitation impact includes high confidentiality (C:H) and high integrity (I:H) breaches. The adversary gains the capability to bypass security controls to read critical proprietary financial data, as well as perform unauthorized creation, modification, and deletion of sensitive records across the entire dataset accessible to Oracle Hyperion Financial Management. Availability (A:N) remains unaffected, ensuring the service continues to operate while under compromise."
}