Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:51.777Z",
  "pubdate": "2026-08-18T21:17:51.777Z",
  "executiveSummary": "A vulnerability has been identified within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. This security flaw is categorized as a difficult-to-exploit vulnerability that can be leveraged by a low-privileged attacker with network access via the HTTP protocol. Successful exploitation of this vulnerability compromises the target system, potentially leading to a complete takeover of Oracle Hyperion Financial Management. The vulnerability carries a CVSS 3.1 Base Score of 7.5, indicating severe impacts across confidentiality, integrity, and availability. The attack vector is network-based, requiring high attack complexity, low privileges, and no user interaction, operating within a scope-unchanged context.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management, specifically affecting version 11.2.25.0.000. The root cause stems from insufficient security controls or validation mechanisms within the affected component's handling of HTTP-based network requests. Exploitation of this vulnerability requires the attacker to possess low-privileged network access, authenticating to the application via HTTP. Due to the high attack complexity associated with the flaw, the attacker must overcome specific environmental or structural hurdles to successfully execute the payload. The attack flow begins when the adversary crafts a specialized HTTP request targeting the vulnerable Security component. Upon transmission across the network, the vulnerable application parses and processes the malicious payload without adequate validation or authorization enforcement. Because the attack targets the security mechanisms directly, successful execution bypasses intended access boundaries. This grants the low-privileged attacker unauthorized capabilities within the system. The post-exploitation impact is severe, resulting in the complete takeover of Oracle Hyperion Financial Management. This compromises the confidentiality of sensitive financial data, threatens the integrity of stored records and application logic, and disrupts the availability of the financial management services."
}