Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-08-18T21:18:12.483Z",
  "pubdate": "2026-08-18T21:18:12.483Z",
  "executiveSummary": "A vulnerability has been identified within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. This security flaw is classified as a remotely exploitable vulnerability that impacts data confidentiality and integrity without affecting system availability. The weakness allows an unauthenticated remote attacker to leverage network access via the HTTP protocol to interact with the vulnerable application. Successful exploitation of this vulnerability requires high attack complexity, meaning specific conditions or timing must be met by the threat actor to achieve successful execution. The risk implications include unauthorized read, update, insert, and delete access to a subset of data accessible by Oracle Hyperion Financial Management. Given that the attack vector is network-based and does not require user interaction or prior authentication, organizations utilizing the affected version face potential exposure to data tampering and information disclosure. Remediation requires applying the appropriate vendor-supplied updates or patches specific to version 11.2.25.0.000 to neutralize the underlying flaw within the Security component.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management, specifically affecting version 11.2.25.0.000. The root cause stems from insufficient access controls or improper validation mechanisms within the application handling of HTTP requests, allowing unauthorized interactions under specific execution states. The attack vector is strictly network-based (AV:N), meaning an adversary does not require physical access to the target system and can initiate exploitation remotely over the network using standard HTTP protocols. Although the vulnerability allows unauthenticated access (PR:N) and requires no user interaction (UI:N), the overall exploitability is constrained by a high attack complexity metric (AC:H). This indicates that successful exploitation is not trivial and typically demands precise conditions, race condition handling, or specific input manipulation to bypass existing security boundaries.\nThe attack flow begins when an unauthenticated attacker crafts a specialized HTTP request directed at the network-exposed endpoints of the Oracle Hyperion Financial Management Security component. Because the application fails to adequately enforce authorization checks or correctly process the incoming payload under certain operational states, the crafted request bypasses intended security controls. Upon successful transmission and processing of the payload, the attacker gains unauthorized capabilities against the application data layer. The post-exploitation impact is limited to a subset of accessible data, resulting in unauthorized read access (C:L) as well as unauthorized update, insert, or delete access (I:L). However, the vulnerability does not impact system availability (A:N), meaning denial-of-service conditions cannot be triggered through this specific vector. The scope remains unchanged (S:U), as the vulnerability is confined to the resource domain of the vulnerable Oracle Hyperion Financial Management instance."
}