Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-18T21:18:10.607Z",
  "pubdate": "2026-08-18T21:18:10.607Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Security component of the Oracle Hyperion Financial Management product, specifically affecting version 11.2.25.0.000. This security flaw enables low-privileged network attackers leveraging the HTTP protocol to compromise the affected software installation.\nSuccessful exploitation of this vulnerability has direct implications across confidentiality, integrity, and availability. Attackers can achieve unauthorized read access to a subset of accessible data, as well as unauthorized update, insert, or delete access to portions of data managed by Oracle Hyperion Financial Management. Additionally, the vulnerability allows unauthorized actors to induce a partial denial of service condition against the target application.\nThe CVSS 3.1 base score for this vulnerability is 6.3 with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, reflecting network attack vector accessibility, low attack complexity, low privilege requirements, and no required user interaction within a scope-unchanged context.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The application exposes endpoints over the HTTP protocol that fail to adequately validate or enforce authorization boundaries for authenticated users possessing low privileges.\nThe attack vector is network-based (AV:N), meaning that an adversary does not require physical or local access to the underlying host, provided they can reach the application's HTTP service ports. The attack complexity is rated as low (AC:L), indicating that successful exploitation does not require highly specialized conditions or race-condition timing attacks. Furthermore, user interaction is not required (UI:N), allowing automated or direct programmatic execution of attack payloads.\nTo initiate an attack, a malicious actor must authenticate to the system with low privileges (PR:L). Once authenticated, the attacker submits crafted HTTP requests directed at the vulnerable Security component endpoints. Because of insufficient access control checks and input validation within the affected functions, the application processes the requests without properly verifying whether the executing user possesses the authorization required to perform the requested operations.\nPost-exploitation impacts manifest across multiple vectors. From an integrity perspective, the lack of proper authorization enforcement allows unauthorized insertion, updating, and deletion of data accessible to Oracle Hyperion Financial Management. From a confidentiality perspective, unauthorized read access is granted to a subset of sensitive enterprise data managed within the application context. From an availability perspective, malicious interactions with the vulnerable component can disrupt application processing, resulting in a partial denial of service condition that impairs overall system responsiveness and operational reliability."
}