Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:50.747Z",
  "pubdate": "2026-08-18T21:17:50.747Z",
  "executiveSummary": "A security vulnerability affecting the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000 permits unauthorized or elevated interaction via SQL injection or database query vectors. This easily exploitable flaw allows a low-privileged network attacker to compromise the entire application. Successful exploitation leads to a complete takeover of Oracle Hyperion Financial Management, resulting in high impacts across confidentiality, integrity, and availability. The CVSS 3.1 base score is calculated at 8.8, reflecting the severity of full system compromise achievable by an attacker with minimal privileges and network access. Risk implications include unauthorized data access, modification of critical financial information, and denial of service. Remediation requires strict adherence to vendor-supplied updates and compensating security controls.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from improper neutralization of special elements used in SQL commands, commonly referred to as a SQL vulnerability, allowing low-privileged authenticated users to interact maliciously with the backend database through network access. Exploitation requires network connectivity to the application layer and low privileges within the system, but does not require user interaction. The attack flow begins when an authenticated low-privileged attacker crafts and transmits malicious input containing structured query language syntax via the network vector. Because the vulnerable component fails to adequately validate or sanitize inputs destined for database queries, the malicious payload is executed within the context of the database management system. This improper handling enables the attacker to manipulate database queries, bypass logical access controls, and potentially escalate privileges within the application environment. Post-exploitation impact encompasses the full takeover of Oracle Hyperion Financial Management. The attacker achieves complete control over confidentiality by accessing sensitive financial datasets, integrity by modifying or corrupting critical business records, and availability by disrupting application services. The attack vector is strictly network-based (AV:N), attack complexity is low (AC:L), privileges required are low (PR:L), and user interaction is not required (UI:N), culminating in a scope of unchanged (S:U) with high impacts (C:H/I:H/A:H)."
}