Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:18:12.830Z",
  "pubdate": "2026-08-18T21:18:12.830Z",
  "executiveSummary": "An easily exploitable security vulnerability affects the Oracle Hyperion Financial Management product within the Security component, specifically impacting version 11.2.25.0.000. This vulnerability allows an unauthenticated remote attacker with network access via HTTP to compromise the targeted system without requiring user interaction.\nSuccessful exploitation of this flaw can result in unauthorized data manipulation, specifically granting attackers the capability to perform unauthorized updates, insertions, or deletions of accessible data within Oracle Hyperion Financial Management. Additionally, it enables attackers to induce a partial denial of service (partial DOS) condition against the application.\nThe severity of this issue is reflected in its CVSS 3.1 Base Score of 6.5, with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, highlighting that while confidentiality is not impacted, the integrity and availability of the system are compromised. The primary risk stems from the lack of authentication requirements and network accessibility, which lowers the barrier to entry for malicious actors seeking to compromise financial data integrity and service availability.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The root cause stems from insufficient access controls and validation mechanisms handling incoming HTTP requests, allowing remote entities to bypass intended security boundaries.\nThe attack vector is network-based (AV:N), meaning an adversary does not require physical access or local network positioning. The attack complexity is rated as low (AC:L), indicating that exploitation does not depend on complex preconditions or race conditions. Furthermore, the vulnerability requires zero privileges (PR:N) and no user interaction (UI:N), allowing automated tools or unauthenticated actors to interact directly with the vulnerable interface.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts a malicious HTTP request targeted at the vulnerable Security component of Oracle Hyperion Financial Management. Second, due to inadequate input validation and the absence of pre-authentication checks, the application processes the request. Third, the attacker leverages this interaction to execute unauthorized data modification routines, resulting in the unauthorized update, insertion, or deletion of accessible data. Simultaneously, the crafted payload can resource-exhaust or disrupt internal application logic, culminating in a partial denial of service (partial DOS) condition.\nThe scope of the vulnerability is unchanged (S:U), meaning the impact is strictly confined to the vulnerable Oracle Hyperion Financial Management component itself, without directly escalating to underlying operating system privileges. The impact profile explicitly affects integrity (I:L), permitting unauthorized data alteration, and availability (A:L), causing partial service degradation, while leaving confidentiality (C:N) unimpacted."
}