Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-18T21:17:51.997Z",
  "pubdate": "2026-08-18T21:17:51.997Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Security component of the Oracle Hyperion Financial Management product, specifically affecting version 11.2.25.0.000. This security flaw allows a highly privileged threat actor with network access via the HTTP protocol to compromise the targeted system entirely.\nSuccessful exploitation of this vulnerability leads to a complete system takeover of Oracle Hyperion Financial Management, resulting in catastrophic impacts across all three pillars of the CIA triad: Confidentiality, Integrity, and Availability. The CVSS 3.1 base score is rated at 7.2 with the vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\nThe risk implications are severe, as an attacker possessing elevated administrative privileges can leverage network vectors to subvert security controls, manipulate sensitive financial data, and disrupt critical business operations. The attack vector is network-based with low attack complexity, though it strictly requires high privileges and requires no user interaction.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000, which handles authorization and authentication management processes. The root cause stems from improper validation or insecure handling of administrative requests processed over the HTTP protocol, enabling an authenticated user with high privileges to execute unauthorized administrative actions beyond their intended scope.\nThe attack flow begins when an attacker authenticates to the application with high privileges and submits a specially crafted HTTP request targeting the vulnerable Security component. Due to inadequate input sanitization or broken access controls within the underlying logic of the affected component, the application fails to adequately restrict the high-privilege user's inputs, thereby processing the malicious payload.\nExploitation requirements dictate that the attacker must already possess valid high-level administrative credentials within the application domain. Network exposure is present via standard HTTP communication channels, allowing remote exploitation without requiring physical access or user interaction. The attack complexity is evaluated as low, meaning the exploitation vector is reliable and straightforward for an actor who has already met the prerequisite privilege requirements.\nFollowing successful exploitation, the payload behavior manifests as unauthorized command execution, privilege escalation, or administrative subversion. This grants the attacker complete control over the Oracle Hyperion Financial Management application instance. The post-exploitation impact includes full compromise of the affected system, enabling the complete extraction, modification, or destruction of confidential financial records, along with severe denial of service against critical organizational functions."
}