Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:17:50.393Z",
  "pubdate": "2026-08-18T21:17:50.393Z",
  "executiveSummary": "A vulnerability has been identified within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. This security flaw is classified as a remotely exploitable vulnerability that leverages SQL interactions to compromise the targeted application.\nSuccessful exploitation of this vulnerability grants an attacker unauthorized capabilities, specifically allowing the creation, deletion, or modification of critical data, alongside unauthorized or complete access to all data accessible within Oracle Hyperion Financial Management. The integrity and confidentiality of the system are severely impacted.\nThe attack vector is network-based, requiring low privileges and no user interaction for successful execution. The CVSS 3.1 base score is calculated at 8.1, reflecting significant risks to confidentiality and integrity while maintaining no direct impact on availability. Organizations utilizing the specified affected version face critical data exposure and manipulation risks if unauthorized low-privileged network access is permitted to the database-interacting security modules.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The underlying root cause stems from insecure handling of SQL-based operations, allowing low-privileged authenticated users with network access to interact maliciously with database queries or data access layers.\nExploitation requires an attacker to possess network access to the application endpoints that interface with the database via SQL. Although the attacker must hold low privileges within the system, no user interaction is required to initiate or complete the attack payload successfully.\nThe attack flow proceeds as follows: First, the low-privileged attacker establishes a network connection to the vulnerable Oracle Hyperion Financial Management instance. Second, the attacker formulates and transmits crafted requests that leverage SQL interaction vectors within the Security component. Third, due to insufficient input validation, sanitization, or privilege enforcement during database operations, the application executes the unintended SQL logic.\nPost-exploitation impact includes severe breaches of data confidentiality and integrity. The attacker gains unauthorized capabilities to read critical and restricted Oracle Hyperion Financial Management data, as well as execute unauthorized data creation, modification, and deletion routines across accessible datasets. The scope remains unchanged (S:U), indicating the impact is constrained to the vulnerable application environment itself, but the severity within that boundary remains high (C:H/I:H)."
}