Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T21:17:51.330Z",
  "pubdate": "2026-08-18T21:17:51.330Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Security component of the Oracle Hyperion Financial Management product, specifically affecting version 11.2.25.0.000. This security flaw enables a low-privileged remote attacker with network access via the HTTP protocol to compromise the affected software, leading to significant confidentiality and availability impacts.\nSuccessful exploitation of this vulnerability grants unauthorized access to critical data or complete access to all data accessible within Oracle Hyperion Financial Management, resulting in a severe compromise of organizational data confidentiality. Additionally, attackers can induce an unauthorized partial denial of service (partial DOS) condition, impairing the operational availability of the application.\nThe vulnerability carries a CVSS 3.1 Base Score of 7.1 with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L. The attack vector is network-based, attack complexity is low, privileges required are low, and user interaction is not required. Organizations utilizing the affected version face high risk exposure, necessitating immediate attention to remediation and defense-in-depth strategies to thwart unauthorized data access and service degradation.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from insufficient security controls and access validation within the HTTP-based request handling pathways managed by the affected component. This architectural weakness allows authenticated users with low privileges to bypass intended authorization boundaries enforced by the application.\nExploitation of the vulnerability occurs over the network utilizing the HTTP protocol. Because the attack complexity is categorized as low and user interaction is completely absent, an attacker with valid, low-privileged credentials can construct and transmit specially crafted HTTP requests directly to the vulnerable component without requiring complex prerequisite conditions.\nThe step-by-step attack flow begins with the low-privileged attacker establishing network connectivity to the exposed HTTP interfaces of Oracle Hyperion Financial Management. The attacker authenticates using their assigned low-privileged credentials and submits a targeted HTTP payload designed to exploit the authorization flaw in the Security component. Upon receiving the request, the vulnerable component fails to adequately enforce access control lists or permission checks. This failure allows the malicious input to interact with underlying data structures and processing routines.\nThe post-exploitation impact is twofold. First, the attacker achieves unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Financial Management, leading to a complete breach of confidentiality for sensitive financial information. Second, the execution of specific malicious request patterns triggers resource exhaustion or application instability, resulting in a partial denial of service (partial DOS) that degrades the operational availability of the targeted Oracle Hyperion Financial Management environment."
}