Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-08-18T21:18:11.283Z",
  "pubdate": "2026-08-18T21:18:11.283Z",
  "executiveSummary": "A security vulnerability has been identified within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. This flaw presents a significant risk to enterprise infrastructure by allowing a highly privileged, authenticated local attacker to completely compromise the targeted application.\nThe vulnerability is characterized by a high severity CVSS 3.1 base score of 6.7, reflecting catastrophic impacts on confidentiality, integrity, and availability if successfully exploited. The attack vector is localized, requiring the adversary to already possess interactive logon access to the underlying infrastructure where Oracle Hyperion Financial Management executes.\nDespite the requirement for high privileges and local network exposure, the simplicity of the exploitation method enables a malicious actor to achieve a total takeover of the affected product. This compromises sensitive financial data processing environments and undermines the security posture of the host operating system and associated enterprise systems.\nOrganizations utilizing the affected Oracle Hyperion Financial Management version must implement strict access controls and monitor local system privileges to mitigate unauthorized exploitation vectors.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. Specifically, the flaw allows an adversary who has already established a local interactive logon session on the infrastructure host to leverage existing high privileges to execute unauthorized administrative actions.\nAccording to the CVSS 3.1 metrics, the attack vector (AV) is classified as Local (L), meaning the vulnerability cannot be exploited remotely and requires the attacker to possess prior local access to the target host. The attack complexity (AC) is Low (L), indicating that once the prerequisite access is met, the exploitation steps do not require specialized race conditions or complex environmental manipulation.\nThe privilege requirements (PR) are designated as High (H), necessitating that the attacker operates with elevated privileges on the underlying operating system or within the application infrastructure before initiating the attack sequence. User interaction (UI) is None (N), allowing the exploit to proceed autonomously without requiring manual intervention from other users or system operators.\nThe scope (S) of the vulnerability is Unchanged (U), meaning the impact is confined to the Oracle Hyperion Financial Management product itself rather than escaping to the hypervisor or secondary distinct security domains. However, the resulting impact on confidentiality (C), integrity (I), and availability (A) is rated as High (H).\nThe step-by-step attack flow involves the authenticated high-privileged attacker interacting directly with the vulnerable Security component locally on the executing infrastructure. By abusing internal trust relationships, insecure permission configurations, or flawed authorization checks within the Security component, the attacker bypasses intended functional boundaries. This malicious interaction results in a full system takeover, granting the adversary complete administrative control over Oracle Hyperion Financial Management, its underlying database transactions, financial data stores, and session handling mechanisms."
}