Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data and unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-18T21:18:09.200Z",
  "pubdate": "2026-08-18T21:18:09.200Z",
  "executiveSummary": "A vulnerability exists within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000, allowing low-privileged authenticated attackers to compromise the application over a network via HTTP. The vulnerability is classified as difficult to exploit due to specific attack complexity requirements, but successful exploitation yields significant security impacts across confidentiality, integrity, and availability. An attacker achieving exploitation can cause a complete Denial of Service (DoS) resulting in application hangs or frequently repeatable crashes, alongside unauthorized read, update, insert, and delete access to a subset of accessible application data. The CVSS 3.1 base score is 6.4 with a vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, indicating that network accessibility and low privileges are prerequisites for a successful attack, while user interaction is not required. Organizations utilizing the affected version face operational risks including service disruption and unauthorized data manipulation, necessitating immediate review and application of vendor-supplied patches or defensive hardening controls to mitigate potential exploitation.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management, specifically affecting version 11.2.25.0.000. The flaw manifests in how the application handles requests processed over the HTTP protocol, enabling low-privileged users to interact with sensitive functional routines that lack proper authorization checks or input validation mechanisms. Exploitation requires network access, and the attack vector is categorized as high complexity, implying that an attacker must meet specific precondition criteria or manipulate environmental states to successfully trigger the flaw. The attack flow begins with the authenticated low-privileged attacker establishing an HTTP connection to the vulnerable Oracle Hyperion Financial Management endpoint. The attacker then transmits a crafted request targeting the Security component. Due to inadequate boundary enforcement or improper state management within the vulnerable component, the application processes the malicious payload, leading to memory corruption, resource exhaustion, or unhandled exceptions that manifest as a complete denial of service via application hangs or repeatable crashes. Simultaneously, the lack of strict access controls allows the payload to bypass security boundaries, granting unauthorized read access to a subset of data and unauthorized update, insert, or delete capabilities against accessible data repositories managed by the application. The post-exploitation impact spans all three branches of the CIA triad, degrading data confidentiality and integrity while severely compromising availability. Authentication is required at a low privilege level, yet no user interaction is necessary for the attack to succeed, making automated or script-driven exploitation feasible once the initial access prerequisites and complexity hurdles are overcome."
}