Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T21:17:51.663Z",
  "pubdate": "2026-08-18T21:17:51.663Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Security component of the Oracle Hyperion Financial Management product, specifically affecting version 11.2.25.0.000.\nThe vulnerability allows a low-privileged attacker who has obtained local logon access to the underlying infrastructure where Oracle Hyperion Financial Management executes to compromise the application.\nSuccessful exploitation of this flaw can result in unauthorized creation, deletion, or modification access to critical data and all accessible Oracle Hyperion Financial Management data.\nAdditionally, successful attacks can lead to unauthorized or complete access to all sensitive and critical data managed by the system.\nThe CVSS 3.1 Base Score is 7.1, with high impacts on both confidentiality and integrity, while availability remains unaffected.\nThe attack vector is local, requiring low privileges and no user interaction, demonstrating significant risk for environments with insufficient host-level segregation or hardening.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000, which fails to adequately enforce authorization or access control boundaries for authenticated local users.\nAttack execution requires the threat actor to already possess low-privileged logon access to the host infrastructure hosting the Oracle Hyperion Financial Management execution environment.\nDue to improper access controls or insecure handling of privileged security functions within the vulnerable component, a low-privileged user can leverage local execution capabilities to bypass intended security restrictions.\nThe attack flow involves the local user interacting with the vulnerable Security component routines, escalating their operational capabilities beyond their assigned authorization level.\nOnce the security boundary is bypassed, the attacker gains unauthorized administrative or elevated data access capabilities.\nPost-exploitation impact includes the ability to execute unauthorized data manipulation operations, such as creating, modifying, or deleting critical application data, as well as exfiltrating sensitive financial and operational records.\nThe network exposure is classified as local (AV:L), meaning remote network access is not required to initiate the attack vector, but host-level access is a prerequisite.\nThe complexity of the exploit is low (AC:L), and user interaction is not required (UI:N), allowing an attacker to reliably compromise the confidentiality and integrity (C:H/I:H) of the target application data."
}