Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-18T21:17:54.503Z",
  "pubdate": "2026-08-18T21:17:54.503Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Security component of the Oracle Hyperion Financial Management product, specifically affecting version 11.2.25.0.000. This security flaw enables a low-privileged threat actor with network access via HTTP to compromise the targeted system.\nSuccessful exploitation of this vulnerability mandates human interaction from an individual other than the attacker. Due to a scope change, successful attacks can extend beyond Oracle Hyperion Financial Management to cause significant impacts on additional products.\nThe potential consequences of successful exploitation include unauthorized access to critical data, complete access to all data accessible within Oracle Hyperion Financial Management, and unauthorized update, insert, or delete access to a subset of the accessible data. The severity of this vulnerability is underscored by a CVSS 3.1 Base Score of 7.6, reflecting severe confidentiality impacts and moderate integrity impacts.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The weakness exposes the application to remote exploitation over the network using the HTTP protocol. The CVSS 3.1 vector is defined as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, which details the specific cryptographic and operational metrics of the flaw.\nExploitation requires the attacker to possess low privileges within the application and network access to the HTTP interface. Additionally, the attack vector dictates that successful exploitation requires user interaction from a third party, meaning an authenticated user must execute an action initiated by the attacker, such as interacting with a maliciously crafted link or interface element.\nThe attack flow proceeds via network communications over HTTP where the low-privileged attacker delivers a payload or request to the vulnerable Security component. Because the vulnerability involves a scope change (S:C), the compromise is not strictly confined to the boundaries of Oracle Hyperion Financial Management, allowing the attacker to impact secondary or additional downstream products integrated within the environment.\nPost-exploitation impacts are characterized by severe data exposure and modification risks. An attacker achieving successful execution gains unauthorized read access to critical data and complete access to all data accessible to the Oracle Hyperion Financial Management application. Furthermore, the attacker gains unauthorized write capabilities, enabling them to execute update, insert, or delete operations on a subset of the accessible data."
}