Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:18:09.337Z",
  "pubdate": "2026-08-18T21:18:09.337Z",
  "executiveSummary": "A vulnerability exists within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000, allowing a highly privileged attacker to compromise the application.\nThe flaw is easily exploitable and requires network access via SQL to facilitate successful exploitation.\nSuccessful attacks against this vulnerability can lead to unauthorized creation, deletion, or modification of critical data, alongside unauthorized or complete access to all data accessible within Oracle Hyperion Financial Management.\nThe associated CVSS 3.1 Base Score is 6.5, with impacts specifically affecting confidentiality and integrity while leaving availability unimpacted.\nThe risk implications are significant for organizations utilizing the affected product, as unauthorized data manipulation and exposure directly undermine enterprise financial data integrity and confidentiality requirements.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000.\nExploitation requires the attacker to possess high privileges and network access via SQL to interact with the vulnerable application.\nThe attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring high privileges (PR:H) and no user interaction (UI:N).\nThe scope is unmodified (S:U), indicating that the exploited vulnerability is limited to the Oracle Hyperion Financial Management authorization domain.\nThe root cause involves insecure handling or validation of SQL-based interactions processed by the Security component, enabling malicious queries or operations to bypass intended privilege boundaries.\nDuring an attack, a threat actor with high privileges leverages network access to send specially crafted SQL commands to the vulnerable database or query interface managed by the Security component.\nThe vulnerable component processes the unauthorized SQL input without adequate sanitization or access restriction enforcement.\nThis execution flow permits the attacker to interact directly with backend data stores, granting unauthorized creation, deletion, or modification capabilities over critical financial and operational datasets.\nFurthermore, the post-exploitation impact includes unauthorized or complete access to sensitive information, severely compromising both the confidentiality and integrity of all data accessible through Oracle Hyperion Financial Management."
}