Description
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is located in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. It permits an attacker who can reach the system over HTTP to bypass authentication controls and access the application as an authorized user. This results in confidential financial data being exposed, while integrity and availability remain unaffected.

Affected Systems

Oracle Hyperion Financial Management 11.2.25.0.000 from Oracle Corporation is the sole product and version identified as vulnerable in the advisory.

Risk and Exploitability

The CVSS v3.1 base score of 7.5 classifies the flaw as high severity. The EPSS score of less than 1 % indicates that active exploitation is currently unlikely. Because exploitation requires only HTTP access over the network, the vulnerability can be triggered by any unauthenticated user with network reachability to the Hyperion instance. The flaw is not listed in the CISA KEV catalog, so there is no public evidence of widespread attacks, but the confidentiality risk warrants proactive mitigation.

Generated by OpenCVE AI on August 25, 2026 at 00:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check Oracle’s advisories for an official fix targeting the unauthorized HTTP access flaw, and apply it when released.
  • Block or disable direct HTTP access to the Hyperion application; enforce HTTPS only and restrict inbound traffic to trusted networks.
  • Ensure that authentication mechanisms are properly enforced, remove any legacy or misconfigured endpoints that allow unauthenticated access, and regularly audit access logs for suspicious activity.

Generated by OpenCVE AI on August 25, 2026 at 00:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Confidentiality Compromise in Oracle Hyperion Financial Management

Mon, 24 Aug 2026 23:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Confidentiality Compromise in Oracle Hyperion Financial Management
Weaknesses CWE-287

Mon, 24 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Mon, 24 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-287

Fri, 21 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Bypass in Oracle Hyperion Financial Management
Weaknesses CWE-284
CWE-287

Wed, 19 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Bypass in Oracle Hyperion Financial Management
Weaknesses CWE-284
CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle hyperion Financial Management
CPEs cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Financial Management
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Hyperion Financial Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T16:11:02.592Z

Reserved: 2026-08-04T22:06:34.599Z

Link: CVE-2026-70822

cve-icon Vulnrichment

Updated: 2026-08-24T16:10:58.979Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:37.167

Modified: 2026-08-24T18:12:54.543

Link: CVE-2026-70822

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T01:00:09Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control