Description
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000 enables an unauthenticated attacker with network access via HTTP to compromise the application. Successful exploitation can lead to a full takeover of the system, exposing, modifying, or deleting sensitive financial data and affecting confidentiality, integrity, and availability as indicated by the CVSS vector.

Affected Systems

Oracles Hyperion Financial Management 11.2.25.0.000 is affected; no other products or versions are specifically mentioned as vulnerable.

Risk and Exploitability

The CVSS 3.1 base score of 9.8 marks this as a high‑severity vulnerability. The EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present, but the vulnerability is easily exploitable from any exposed HTTP endpoint and requires no authentication. The lack of a CISA KEV listing does not reduce the potential impact, so administrators should treat it as a high‑priority risk.

Generated by OpenCVE AI on August 24, 2026 at 21:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor–supplied patch for Oracle Hyperion Financial Management 11.2.25.0.000 as released by Oracle.
  • Restrict HTTP exposure of the Hyperion instance by configuring firewall rules or a VPN to allow only trusted IP addresses until the patch is applied.
  • If possible, disable or block the vulnerable security component endpoints within the application until a fix can be implemented.

Generated by OpenCVE AI on August 24, 2026 at 21:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote HTTP Exploit in Oracle Hyperion Financial Management

Mon, 24 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Mon, 24 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-94

Fri, 21 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle Hyperion Financial Management
Weaknesses CWE-20

Wed, 19 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle Hyperion Financial Management
Weaknesses CWE-20

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hyperion Financial Management
CPEs cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Financial Management
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Hyperion Financial Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T14:22:40.013Z

Reserved: 2026-08-04T22:06:34.599Z

Link: CVE-2026-70817

cve-icon Vulnrichment

Updated: 2026-08-24T13:41:24.622Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:36.490

Modified: 2026-08-24T18:40:45.203

Link: CVE-2026-70817

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T21:15:07Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')