Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 4.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-18T21:18:15.940Z",
  "pubdate": "2026-08-18T21:18:15.940Z",
  "executiveSummary": "A security vulnerability has been identified within the Oracle Hyperion Financial Management product, specifically affecting the Security component in version 11.2.25.0.000. This vulnerability is classified as difficult to exploit and requires a low-privileged attacker to have logon access to the underlying infrastructure where Oracle Hyperion Financial Management executes. Furthermore, successful exploitation mandates human interaction from a user other than the attacker.\nWhen successfully exploited, the vulnerability impacts confidentiality, integrity, and availability, granting the adversary unauthorized read access to a subset of accessible data, unauthorized update, insert, or delete capabilities against specific data assets, and the ability to trigger a partial denial of service (partial DOS) condition against the application. Given the specific prerequisites involving local infrastructure access and mandatory user interaction, the overall risk is mitigated by these operational constraints, though the compromise results in multi-faceted security degradation for the targeted enterprise deployment.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The attack vector is localized (AV:L), meaning the adversary must already possess authenticated logon capabilities to the host operating system or infrastructure infrastructure executing the Oracle Hyperion Financial Management binaries and services. The attack complexity is rated as high (AC:H), indicating that successful exploitation relies on specific, non-standard conditions or complex race conditions within the environment.\nPrivilege requirements are constrained to a low level (PR:L), signifying that an unprivileged or low-privileged user account on the host infrastructure is sufficient to initiate the attack sequence. Additionally, the exploit vector requires explicit human interaction (UI:R), meaning an authenticated interactive user or administrator must perform a secondary action—such as interacting with a crafted interface element or process—to advance the attack chain. The scope remains unchanged (S:U), as the privileges and security constraints of the exploited component are not bypassed to affect broader underlying resources outside the application boundary.\nThe attack flow proceeds through distinct stages. First, the low-privileged attacker establishes an interactive or programmatic session on the target infrastructure hosting Oracle Hyperion Financial Management. Second, leveraging local access to the execution environment, the attacker manipulates application inputs, configuration states, or inter-process communication mechanisms associated with the vulnerable Security component. Third, the attacker induces a state requiring human interaction from another user or administrator, who inadvertently triggers the payload execution during routine management or operational tasks. Upon successful triggering, the payload executes within the context of the application, leading to unauthorized read access to a subset of sensitive data, unauthorized insertion, modification, or deletion of application data sets, and resource exhaustion or application instability resulting in a partial denial of service (partial DOS)."
}