Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:18:12.713Z",
  "pubdate": "2026-08-18T21:18:12.713Z",
  "executiveSummary": "A vulnerability has been identified within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000, presenting significant risk to enterprise availability. This security flaw is classified as a Denial of Service (DoS) vulnerability that specifically impacts the application's availability metrics under the Common Vulnerability Scoring System (CVSS v3.1), yielding a Base Score of 5.3 with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H.\nThe vulnerability allows a low-privileged authenticated attacker with network access via the HTTP protocol to compromise the targeted system. Successful exploitation requires high attack complexity but does not rely on user interaction. When exploited, the vulnerability enables the threat actor to induce an application hang or cause a frequently repeatable crash, resulting in a complete Denial of Service for Oracle Hyperion Financial Management. Confidentiality and integrity impacts remain unaffected, as the vulnerability is strictly confined to resource exhaustion and service disruption.\nFrom a risk perspective, this flaw undermines operational continuity for financial reporting systems where uptime is critical. Attackers possessing standard user credentials can leverage network channels to disrupt business-critical financial consolidation and analysis processes, necessitating prompt defensive hardening and patch application upon vendor release.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. It manifests as a flaw that allows remote, low-privileged users to exhaust or destabilize application resources through specific HTTP interactions. The root cause centers on improper handling of network-based requests processed by the vulnerable Security component, leading to conditions such as unhandled exceptions, infinite loops, or severe memory and thread exhaustion.\nTo execute an attack, the threat actor must possess low-privileged network access to the application instance via HTTP. Although the vulnerability requires high attack complexity—indicating that specific conditions, timing, or precise payload construction must be met for successful triggering—it requires no user interaction and can be executed entirely over the network. The attack flow begins when the malicious or malformed HTTP request is transmitted by the authenticated attacker to the vulnerable Oracle Hyperion Financial Management endpoint.\nUpon receipt, the Security component parses and processes the payload. Due to inadequate input validation, exception handling, or resource management within the affected function, the application enters an unstable state. This state triggers either a complete application hang, rendering threads unresponsive to subsequent legitimate requests, or a catastrophic application crash. Because the crash condition is frequently repeatable, an attacker can continuously disrupt service availability, effectively maintaining a persistent Denial of Service state against the Oracle Hyperion Financial Management environment. The post-exploitation impact is limited to availability degradation; the vulnerability does not grant mechanisms for remote code execution, privilege escalation, or unauthorized access to sensitive financial data."
}