Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:52.587Z",
  "pubdate": "2026-08-18T21:17:52.587Z",
  "executiveSummary": "A remotely exploitable security vulnerability affects the Oracle Hyperion Financial Management product within the Security component, specifically targeting version 11.2.25.0.000. This vulnerability exposes the application to low-privileged attackers who possess network access via the TCP protocol. Successful exploitation of this flaw can lead to the complete takeover of the affected Oracle Hyperion Financial Management system, granting unauthorized entities full control over critical financial data and operational processes.\nThe severity of this issue is reflected in its CVSS 3.1 Base Score of 8.8, indicating high impacts across all primary security pillars: Confidentiality, Integrity, and Availability. The attack vector is network-based with low attack complexity, requiring no user interaction, though it does mandate low privileges. Consequently, the risk implication is severe, as compromised instances can be leveraged by malicious actors to manipulate financial reporting, exfiltrate sensitive enterprise data, or disrupt business operations entirely. Organizations running the impacted version must address this high-risk vector promptly to prevent unauthorized system compromise.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from insufficient validation and authorization checks within the security subsystem handling network-based communications over TCP. Because the attack vector is network (AV:N) with low attack complexity (AC:L), an adversary does not require complex physical access or intricate timing conditions to interact with the vulnerable service.\nTo execute an attack, a threat actor must authenticate to the network with low privileges (PR:L). Utilizing standard TCP communication protocols, the attacker interacts directly with the vulnerable Security component endpoints exposed by Oracle Hyperion Financial Management. Due to inadequate input sanitization and flawed access control enforcement within the affected functions, the low-privileged attacker can inject crafted requests designed to bypass security boundaries.\nThe attack flow proceeds as follows: First, the authenticated attacker establishes a TCP connection to the target Oracle Hyperion Financial Management service. Second, the attacker transmits a specially crafted payload targeting the Security component. Third, the vulnerable application processes the malicious input without proper validation or privilege verification, leading to unauthorized execution paths. Finally, the payload execution grants the attacker elevated privileges or direct administrative control over the application architecture.\nThe post-exploitation impact includes a total system takeover (C:H, I:H, A:H). Once control is achieved, the malicious actor can compromise the confidentiality of sensitive financial datasets, integrity of stored records, and availability of the service. No user interaction (UI:N) is required for this attack to succeed, making automated exploitation or direct manual targeting highly effective once initial low-privileged credentials are obtained."
}