Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:52.113Z",
  "pubdate": "2026-08-18T21:17:52.113Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Security component of the Oracle Hyperion Financial Management product, specifically affecting version 11.2.25.0.000. This security flaw allows a low-privileged remote attacker with network access via the HTTP protocol to compromise the targeted system entirely. Successful exploitation of this vulnerability results in a complete takeover of Oracle Hyperion Financial Management, granting the adversary full control over the application environment.\nThe vulnerability carries a CVSS 3.1 Base Score of 8.8, reflecting high severity impacts across confidentiality, integrity, and availability. The attack vector is network-based, requiring low privileges and no user interaction, while the scope remains unchanged. Given the critical nature of financial management systems, a successful attack compromises sensitive corporate financial data, disrupts business operations, and undermines the overall integrity of the enterprise infrastructure. Organizations running the affected version face significant risk until appropriate remediation measures are applied.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from insufficient validation and handling of security requests processed by the application via network endpoints. Because the application exposes vulnerable logic over the HTTP protocol, an adversary who possesses low-privileged credentials can interact directly with the exposed interface.\nThe attack vector relies on network accessibility. An attacker initiates the exploitation phase by crafting malicious HTTP requests targeting the vulnerable Security component. Due to inadequate access controls and input processing flaws within the component, the low-privileged attacker is able to bypass intended authorization boundaries. The payload submitted via the network leverages these logic flaws to execute unauthorized administrative or system-level actions within the context of the application.\nThe step-far attack flow proceeds as follows: First, the attacker establishes network connectivity to the Oracle Hyperion Financial Management instance via HTTP. Second, the attacker authenticates using valid low-privileged credentials to meet the prerequisite access requirement. Third, the attacker transmits a specifically crafted HTTP payload targeting the Security component. Fourth, the vulnerable component processes the malicious input without proper validation, leading to privilege escalation or unauthorized command execution. Finally, the attacker achieves complete system compromise, resulting in the full takeover of the Oracle Hyperion Financial Management application, allowing for unrestricted read, write, and execute capabilities over confidential data and underlying system operations."
}