Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T21:18:13.060Z",
  "pubdate": "2026-08-18T21:18:13.060Z",
  "executiveSummary": "A security vulnerability has been identified in the Oracle Hyperion Financial Management product of Oracle Hyperion, specifically within the Security component. The vulnerability affects the supported version 11.2.25.0.000. This security flaw is easily exploitable by an unauthenticated attacker who has network access via the HTTP protocol, allowing them to compromise the target application. Successful exploitation of this vulnerability mandates human interaction from a third party other than the attacker, such as tricking a user into interacting with a malicious link or crafted interface element. The consequences of a successful attack include unauthorized update, insert, or delete access to a subset of data accessible within Oracle Hyperion Financial Management, alongside unauthorized read access to a corresponding subset of sensitive data. The severity of this vulnerability is characterized by a CVSS 3.1 Base Score of 5.4, with impacts specifically affecting confidentiality and integrity while leaving availability unaffected. Given the network vector and low attack complexity, organizations utilizing the affected version face moderate risk regarding data exposure and unauthorized modification of financial records.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000, exposed over the HTTP protocol via network access. The root cause stems from insufficient validation or sanitization of input processed by the web application, or improper session and request handling that can be leveraged when a user with an active session is manipulated into executing specific actions.\nThe attack vector is network-based (AV:N), meaning the attacker does not require local access to the underlying operating system and can target the application remotely over HTTP. The attack complexity is rated as low (AC:L), indicating that the exploitation path does not require highly specialized conditions or complex race conditions to succeed. Furthermore, the vulnerability requires no prior authentication (PR:N), allowing any anonymous network user to initiate the attack sequence.\nExploitation requires mandatory human interaction (UI:R). Typically, this involves social engineering tactics where an attacker entices an authenticated user to perform a specific action via the browser, such as clicking a malicious link or visiting a compromised webpage that automatically submits crafted HTTP requests to the vulnerable Oracle Hyperion Financial Management instance.\nUpon successful execution of the attack leveraging the victim's authenticated session and browser context, the attacker bypasses intended security controls. This grants the adversary unauthorized read access to a subset of sensitive data accessible by the application, as well as unauthorized write, update, and delete access to application-accessible data. The scope remains unchanged (S:U), meaning the impact is strictly confined to the vulnerable component itself without escalating to broader underlying host system privileges or hypervisor layers. The Confidentiality and Integrity metrics are impacted at a low level (C:L/I:L), while Availability remains entirely unaffected (A:N)."
}