Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:17:55.537Z",
  "pubdate": "2026-08-18T21:17:55.537Z",
  "executiveSummary": "A security vulnerability has been identified within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000, presenting significant risk to enterprise financial data confidentiality. This vulnerability allows an authenticated attacker with low privileges and network access via HTTP to compromise the affected software, leading to unauthorized access to critical data or complete access to all accessible application data. The security flaw is categorized with a CVSS 3.1 Base Score of 6.5, reflecting a high impact on confidentiality with no direct integrity or availability disruption. Exploitation requires minimal attacker capabilities, specifically low privileges within the application domain, but does not necessitate user interaction. Given the critical nature of financial management systems, successful exploitation could expose sensitive corporate financial records, proprietary accounting data, and strategic business metrics. Organizations utilizing the affected version must prioritize defensive measures, access reviews, and remediation protocols to mitigate potential unauthorized data exposure risks.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management, specifically affecting version 11.2.25.0.000. The underlying root cause involves insufficient access control enforcement or authorization checks within the application's security architecture, which fails to properly validate whether a low-privileged user possesses the requisite entitlements to access sensitive financial datasets.\nThe attack vector is network-based via HTTP (AV:N), meaning that any adversary with standard network connectivity to the vulnerable Oracle Hyperion Financial Management instance can initiate exploitation attempts. The attack complexity is rated as low (AC:L), indicating that the flaw does not require advanced evasion techniques, complex race conditions, or highly specialized pre-conditions to exploit successfully. Furthermore, user interaction is not required (UI:N), allowing for automated or direct script-based exploitation.\nRegarding attacker requirements, the exploit mandates low privileges (PR:L), meaning the adversary must authenticate against the system with standard user credentials. However, once authenticated, the attacker can leverage the authorization bypass or privilege boundary breakdown within the Security component to exceed their designated scope of access.\nThe step-by-step attack flow proceeds as follows: First, the low-privileged attacker establishes an HTTP connection to the Oracle Hyperion Financial Management endpoint exposing the vulnerable Security component. Second, the attacker crafts and transmits malicious or unauthorized requests designed to query financial data structures or administrative functions that should normally be restricted by role-based access controls. Third, due to the failure of the Security component to properly enforce authorization policies for the requesting session, the application processes the request and returns the sensitive data. Finally, the attacker captures the response, resulting in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data, culminating in a severe confidentiality breach (C:H) without impacting system integrity (I:N) or availability (A:N)."
}