Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:17:56.103Z",
  "pubdate": "2026-08-18T21:17:56.103Z",
  "executiveSummary": "A security vulnerability has been identified within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. This vulnerability presents a specific risk to confidentiality by allowing unauthorized access to critical or complete datasets managed within the application. Classified as a difficult-to-exploit flaw, it requires specific attacker preconditions, including low-level privileges and network access via the HTTP protocol. Although the attack complexity is considered high, a successful exploit grants the adversary unauthorized data access capabilities without compromising system integrity or availability. Organizations utilizing the affected Oracle Hyperion Financial Management version face potential exposure of sensitive financial data if the underlying security controls are bypassed. The risk implications center strictly on confidentiality impacts, making remediation or applying vendor-supplied updates critical for maintaining data security and compliance within enterprise environments.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management, specifically affecting version 11.2.25.0.000. The security flaw stems from insufficient access controls and validation mechanisms within the application's handling of HTTP-based requests. Exploitation of this vulnerability requires the attacker to possess low-privileged user credentials within the targeted system and network connectivity to the application via HTTP. Due to the high attack complexity metric defined by the CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), successful exploitation typically demands precise timing, specific environmental conditions, or manipulation of complex request parameters to bypass intended security boundaries.\nThe attack flow begins when an authenticated, low-privileged user crafts a specialized HTTP request directed at the vulnerable Security component of Oracle Hyperion Financial Management. The request leverages the high-complexity attack vector to circumvent authorization checks enforced by the application layer. By exploiting the underlying logic flaw in how the component processes session states or access permissions, the attacker forces the application to return sensitive data normally restricted to higher-privileged roles, such as administrators or data owners. The payload behavior focuses exclusively on data exfiltration rather than code execution, privilege escalation, system modification, or denial of service.\nPost-exploitation impact is strictly localized to confidentiality, resulting in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. Integrity and availability metrics remain unaffected, as the vulnerability does not allow for data alteration, deletion, or service disruption. The attack vector is strictly network-based (AV:N), requiring no user interaction (UI:N) and maintaining an unchanged security scope (S:U), meaning the privileges gained are confined to the context of the application's data repository."
}