Description
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).
Published: 2026-08-18
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated attacker with network access over HTTPS can exploit a flaw in the Oracle Hyperion Financial Reporting Server component to gain unauthorized access to all reporting data or selectively obtain critical information. In addition to data exposure, repeated or sustained attacks can exhaust server resources, causing a partial denial of service that would degrade availability for legitimate users.

Affected Systems

The Oracle Hyperion Financial Reporting product, version 11.2.25.0.000, is the sole affected release per the CNA data. No other versions or editions are listed as impacted.

Risk and Exploitability

The CVSS v3.1 base score of 8.2 signifies high severity, with low attack complexity and no user interaction required. The EPSS score of less than 1% indicates a low current exploitation probability, yet the vulnerability is network‑exposed via HTTPS and is easily exploitable, presenting a significant risk. The flaw is not yet listed in the CISA KEV catalog, but its characteristics suggest it could be a target for automated exploitation.

Generated by OpenCVE AI on August 21, 2026 at 07:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch for Hyperion Financial Reporting 11.2.25.0.000 as soon as it becomes available.
  • Restrict access to the Hyperion HTTPS service to trusted IP addresses or internal networks to limit exposure.
  • Place the service behind a firewall or VPN and monitor for unusual or repeated HTTPS traffic that may indicate exploitation attempts.

Generated by OpenCVE AI on August 21, 2026 at 07:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle hyperion Financial Management
CPEs cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle hyperion Financial Management

Fri, 21 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTPS Data Access and Partial Denial of Service in Oracle Hyperion Financial Reporting

Wed, 19 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTPS Access Enables Data Compromise and Partial Denial of Service in Oracle Hyperion Financial Reporting
Weaknesses CWE-287

Wed, 19 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTPS Access Enables Data Compromise and Partial Denial of Service in Oracle Hyperion Financial Reporting
Weaknesses CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).
First Time appeared Oracle
Oracle hyperion Financial Reporting
CPEs cpe:2.3:a:oracle:hyperion_financial_reporting:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Financial Reporting
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L'}

Subscriptions

Oracle Hyperion Financial Management Hyperion Financial Reporting
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T12:55:13.384Z

Reserved: 2026-08-04T22:06:34.594Z

Link: CVE-2026-70743

cve-icon Vulnrichment

Updated: 2026-08-19T12:11:34.669Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:27.113

Modified: 2026-08-24T16:15:35.047

Link: CVE-2026-70743

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T08:00:08Z

Weaknesses