Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-18T21:17:53.270Z",
  "pubdate": "2026-08-18T21:17:53.270Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Security component of the Oracle Hyperion Financial Management product, specifically affecting version 11.2.25.0.000. This security flaw allows a highly privileged threat actor with network access via the HTTP protocol to compromise the targeted application entirely, leading to a complete system takeover. The severity of this issue is underscored by a CVSS 3.1 Base Score of 7.2, reflecting high impacts across confidentiality, integrity, and availability vectors. The risk implications are severe, as successful exploitation compromises the foundational security posture of the financial management system, potentially exposing sensitive enterprise financial data, allowing unauthorized modification of critical records, and causing operational downtime. The attack vector is network-based, requiring low attack complexity, no user interaction, but necessitates high privileges within the application's access control framework. Organizations utilizing the affected version must prioritize remediation to neutralize the risk of unauthorized administrative takeover and safeguard critical financial infrastructure.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from insufficient security controls and validation mechanisms within the administrative or security management functions exposed over the HTTP protocol. Because the application exposes these critical interfaces via network protocols, an adversary who has successfully authenticated with high privileges can interact directly with the vulnerable component.\nExploitation requires the attacker to possess elevated privileges and network connectivity to the HTTP service hosting Oracle Hyperion Financial Management. The attack flow initiates when the authenticated high-privileged attacker crafts and transmits malicious requests targeting the vulnerable Security component. Due to the lack of adequate input validation, state verification, or authorization checks within the targeted functions, the application improperly processes the crafted payload.\nThis behavior allows the attacker to bypass intended architectural constraints, escalate operational privileges further, or execute arbitrary administrative actions. The payload behavior facilitates the complete subversion of the application's authorization and access control logic, granting the adversary absolute administrative control over the Oracle Hyperion Financial Management environment. Post-exploitation impact encompasses total compromise of the application layer, yielding severe repercussions for the CIA triad: complete loss of confidentiality via unauthorized access to sensitive financial databases and configurations, total compromise of integrity through arbitrary alteration of application data and security policies, and complete availability disruption via administrative service termination or sabotage."
}