Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:18:11.167Z",
  "pubdate": "2026-08-18T21:18:11.167Z",
  "executiveSummary": "A vulnerability has been identified within the Security component of Oracle Hyperion Financial Management, specifically affecting version 11.2.25.0.000. This security flaw is categorized as a difficult to exploit vulnerability that can be leveraged by a low-privileged threat actor over the network via the HTTP protocol.\nSuccessful exploitation of this vulnerability grants unauthorized access to critical data or complete access to all data accessible within Oracle Hyperion Financial Management, impacting the confidentiality vector of the application. The vulnerability carries a CVSS 3.1 Base Score of 5.3 with a vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N.\nThe risk implications are significant for organizations utilizing the affected product, as unauthorized exposure of sensitive financial data can lead to regulatory non-compliance, loss of proprietary business intelligence, and potential downstream compromise. Although the attack complexity is rated as high, the combination of network accessibility and low privilege requirements necessitates rigorous monitoring and prompt remediation to prevent potential data exfiltration attempts.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from insufficient access controls or authorization validation mechanisms within the affected component, allowing authenticated users with minimal privileges to bypass boundary restrictions and access unauthorized data resources.\nExploitation of this vulnerability requires network access via the HTTP protocol. An attacker must possess low-level privileges within the application context, meaning anonymous or unauthenticated entities cannot directly exploit this flaw without first acquiring valid credentials. Furthermore, the vulnerability is classified as having a high attack complexity, indicating that successful exploitation likely requires specific conditions, precise timing, or nuanced manipulation of request parameters to circumvent existing security controls.\nThe attack flow proceeds as follows: First, the low-privileged attacker establishes a network connection to the target Oracle Hyperion Financial Management instance over HTTP. Second, the attacker crafts specialized requests targeting the vulnerable Security component, potentially manipulating input vectors or leveraging logic flaws to bypass authorization checks. Third, due to inadequate validation of user privileges against sensitive data stores, the application processes the request and returns unauthorized data to the attacker. No user interaction is required for the attack to succeed.\nThe post-exploitation impact is strictly confined to confidentiality, resulting in unauthorized access to critical data or complete read access to all data repositories accessible by the Oracle Hyperion Financial Management instance. Integrity and availability vectors remain unaffected, as the vulnerability does not facilitate data modification, deletion, or denial of service conditions."
}