Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-18T21:18:08.750Z",
  "pubdate": "2026-08-18T21:18:08.750Z",
  "executiveSummary": "A vulnerability exists within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000, allowing authenticated high-privileged threat actors to compromise data confidentiality.\nThe flaw is categorized as an easily exploitable vulnerability that can be leveraged remotely over the HTTP network protocol without requiring user interaction.\nSuccessful exploitation grants unauthorized access to critical data or complete access to all accessible data residing within the Oracle Hyperion Financial Management environment, strictly impacting system confidentiality.\nThe risk implication is significant for organizations utilizing the affected software, as administrative or high-privileged compromises can expose sensitive financial records and proprietary enterprise metrics.\nPrerequisites for a successful attack include network connectivity to the target application and valid high-level privileges within the Security component.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management, specifically affecting version 11.2.25.0.000.\nThe root cause stems from insufficient access controls or authorization validation mechanisms within the Security subsystem, which fails to adequately restrict high-privileged sessions from accessing unauthorized data domains.\nExploitation requires the attacker to possess high privileges and network access to the application via the HTTP protocol.\nThe attack flow proceeds as follows: First, the authenticated attacker establishes a network connection to the vulnerable Oracle Hyperion Financial Management instance over HTTP. Second, leveraging their high-privileged access, the attacker submits crafted requests targeting the flawed Security component.\nBecause the component lacks proper authorization enforcement, it fails to validate whether the high-privileged user is explicitly authorized to access the requested data segments.\nConsequently, the server processes the request and returns sensitive data to the attacker, bypassing intended logical access boundaries.\nThe post-exploitation impact is limited to the confidentiality vector, resulting in unauthorized retrieval of critical data or complete exposure of all data accessible to the Oracle Hyperion Financial Management application.\nThe vulnerability score metrics dictate a CVSS 3.1 Base Score of 4.9, with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, highlighting the network attack vector, low attack complexity, high privilege requirement, and absence of integrity or availability impacts."
}