Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-18T21:18:12.593Z",
  "pubdate": "2026-08-18T21:18:12.593Z",
  "executiveSummary": "A vulnerability exists within the Security component of the Oracle Hyperion Financial Management product, specifically affecting version 11.2.25.0.000. This security flaw is categorized as a high-privilege, locally exploitable vulnerability that can lead to the complete compromise of the targeted enterprise application.\nThe vulnerability carries a CVSS 3.1 Base Score of 6.4, with a vector of (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating that the attack vector is local, attack complexity is high, privileges required are high, user interaction is not required, and scope is unchanged. The impacts on confidentiality, integrity, and availability are all rated as high.\nSuccessful exploitation of this vulnerability allows a highly privileged authenticated attacker with local access to the underlying infrastructure where Oracle Hyperion Financial Management executes to achieve a full system takeover. Risk implications include total loss of control over sensitive financial data, unauthorized modification of financial records, and severe disruption of enterprise financial consolidation and reporting operations.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The attack surface is exposed locally to the underlying infrastructure hosting the application runtime environment, requiring the adversary to already possess elevated administrative privileges on the host system prior to initiating the attack sequence.\nThe exploitation method relies on the attacker leveraging their high privileges to interact with insecurely configured internal mechanisms, insecure file permissions, or improperly secured inter-process communication channels associated with the Security component. Because the attack complexity is rated as high, successful exploitation requires precise conditions, specific environmental configurations, and deep familiarity with the internal architecture of the Oracle Hyperion Financial Management deployment.\nThe attack flow proceeds as follows: First, the adversary establishes high-privileged access to the host infrastructure executing Oracle Hyperion Financial Management. Second, leveraging this local access, the attacker interacts with vulnerable administrative interfaces, misconfigured local system files, or privileged execution contexts managed by the Security component. Third, by exploiting the underlying security flaw, the attacker bypasses remaining authorization boundaries or injects unauthorized directives into the execution pipeline of the Security component. Finally, the malicious payload executes within the context of the application's privileged service account, granting the attacker complete control over the Oracle Hyperion Financial Management instance.\nPost-exploitation impact includes full administrative takeover of the Oracle Hyperion Financial Management application, enabling the adversary to manipulate financial data, access confidential corporate records, modify security controls, and disrupt availability across dependent financial consolidation workflows."
}