Description
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Published: 2026-08-18
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw lies in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000 and permits a low-privileged local user who can log onto the host to read, insert, update or delete protected financial records. The resulting breach allows attackers to compromise confidential information and alter data integrity, matching the CVSS profile of high confidentiality impact and low integrity impact.

Affected Systems

Oracle Hyperion Financial Management released by Oracle Corporation in version 11.2.25.0.000 is affected. No other versions or components are reported as vulnerable.

Risk and Exploitability

The vulnerability is exploitable locally: an attacker must first obtain a legitimate host login, then may leverage the flaw without further privileges. The CVSS score of 6.1 indicates moderate severity, and the EPSS score (< 1 % ) suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, but given the sensitivity of financial data it warrants prompt attention and remediation.

Generated by OpenCVE AI on August 25, 2026 at 00:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle security patch for Hyperion Financial Management 11.2.25.0.000 as detailed in the Oracle August 2026 security advisory.
  • Restrict local logon rights to users who require access to the Hyperion instance; remove or disable unused or default accounts.
  • Audit the privileges of users on the host running Hyperion and enforce the principle of least privilege.

Generated by OpenCVE AI on August 25, 2026 at 00:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
Title Local Logon Provides Unauthorized Access to Oracle Hyperion Financial Management Data

Mon, 24 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Title Local Access to Hyperion Financial Management Data via Security Component Vulnerability
Weaknesses CWE-668

Mon, 24 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Fri, 21 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
Title Local Access to Hyperion Financial Management Data via Security Component Vulnerability
Weaknesses CWE-284
CWE-668

Fri, 21 Aug 2026 05:15:00 +0000

Type Values Removed Values Added
Title Local Privilege‑Escalation in Oracle Hyperion Financial Management Enables Unauthorized Data Access
Weaknesses CWE-284
CWE-668

Wed, 19 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
Title Local Privilege‑Escalation in Oracle Hyperion Financial Management Enables Unauthorized Data Access
Weaknesses CWE-284
CWE-668

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
First Time appeared Oracle
Oracle hyperion Financial Management
CPEs cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Financial Management
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Oracle Hyperion Financial Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T19:54:20.074Z

Reserved: 2026-08-04T22:06:34.600Z

Link: CVE-2026-70838

cve-icon Vulnrichment

Updated: 2026-08-24T19:49:16.520Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:17:39.330

Modified: 2026-08-24T20:17:09.393

Link: CVE-2026-70838

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T00:45:04Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control