Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 4.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-18T21:18:10.827Z",
  "pubdate": "2026-08-18T21:18:10.827Z",
  "executiveSummary": "A denial of service vulnerability affects the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. This vulnerability allows a low-privileged attacker with local logon access to the underlying infrastructure to compromise the application's availability.\nSuccessful exploitation results in an unauthorized ability to cause a hang or frequently repeatable crash, leading to a complete denial of service (DoS) for Oracle Hyperion Financial Management.\nThe vulnerability is characterized by a CVSS 3.1 Base Score of 4.7 with a vector of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local attack vector requirements, high attack complexity, low privileges required, no user interaction, and impact limited strictly to system availability with no confidentiality or integrity compromise.\nRisk implications are centered on operational disruption and service downtime, threatening business continuity for financial reporting environments reliant on continuous availability of the Hyperion Financial Management platform.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000, specifically impacting how the application handles internal security routines and resource management during execution.\nThe root cause stems from improper handling of specific operations or resource allocations within the Security module, which can be triggered locally to destabilize the application process space.\nExploitation requires the attacker to possess local logon access to the host infrastructure where Oracle Hyperion Financial Management executes, classifying the attack vector as Local (AV:L).\nThe attack complexity is designated as High (AC:H), implying that specific race conditions, precise timing, or particular state configurations must be met by the adversary to successfully trigger the flaw.\nThe attacker must authenticate with low privileges (PR:L) within the local operating system environment, meaning unprivileged external entities without infrastructure access cannot directly initiate the attack sequence.\nNo user interaction (UI:N) is required for successful exploitation, and the scope remains unchanged (S:U), restricting the direct impact to the vulnerable application component without escalating privileges to other hypervisor or kernel layers.\nThe attack flow proceeds as follows: First, the low-privileged attacker authenticates locally to the infrastructure hosting Oracle Hyperion Financial Management. Second, the attacker leverages specialized local execution capabilities or interacts with the Security component to supply malformed inputs or trigger resource-intensive routines. Third, due to the lack of robust input validation or exception handling within the affected component, the application encounters an unhandled exception or enters an infinite resource consumption loop. Finally, this condition results in either an application hang or a complete, repeatable crash, denying access to legitimate users and halting financial management operations."
}