Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-18T21:17:52.347Z",
  "pubdate": "2026-08-18T21:17:52.347Z",
  "executiveSummary": "A security vulnerability exists within the Oracle Hyperion Financial Management product, specifically affecting the Security component in version 11.2.25.0.000. This vulnerability allows a remote attacker with low privileges and network access via HTTP to compromise the affected system. Due to a scope change, successful exploitation can result in significant security impacts extending beyond the primary application, leading to unauthorized access to critical data or complete access to all data accessible via Oracle Hyperion Financial Management. The vulnerability is characterized by a CVSS 3.1 Base Score of 7.7, with severe confidentiality impacts. Exploitation requires low attack complexity and does not require user interaction, though authenticated low-privileged network access is a prerequisite.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The flaw allows an authenticated user with low privileges to leverage network access via the HTTP protocol to bypass intended authorization controls. The root cause stems from improper access controls or insufficient validation of security context within the affected component, enabling lateral or vertical privilege escalation relative to data accessibility across integrated or dependent environments, as indicated by the scope change (S:C) metric in the CVSS vector.\nThe attack flow begins with the adversary authenticating to the application with low privileges. Utilizing network access over HTTP, the attacker submits crafted requests targeting the vulnerable Security component. Because the application fails to adequately enforce authorization boundaries or properly validate the scope of the user's permissions, the request is processed successfully. This allows the attacker to query, read, or exfiltrate sensitive information that should be restricted based on the user's initial privilege level.\nThe exploitation vector is entirely network-based (AV:N), requiring low attack complexity (AC:L) and no user interaction (UI:N). The primary post-exploitation impact is a complete breach of data confidentiality (C:H) regarding all data accessible to the Oracle Hyperion Financial Management environment, while integrity (I:N) and availability (A:N) remain unimpacted."
}