Description
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-08-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A security flaw exists in the Oracle Hyperion Financial Management component "Security" for version 11.2.25.0.000. An unauthenticated user who can reach the application over HTTP can exploit this flaw to read a subset of data that should be protected, resulting in a confidentiality impact that allows attackers to obtain sensitive financial information.

Affected Systems

The vulnerability affects only Oracle Corporation's Oracle Hyperion Financial Management product version 11.2.25.0.000. No other versions or vendor products are listed as affected.

Risk and Exploitability

With a CVSS 3.1 base score of 5.3, the risk level is moderate. The EPSS score is < 1%, indicating a very low probability of exploitation. Because the flaw is described as easily exploitable over a network connection, an attacker with network access can obtain data immediately via standard HTTP requests. The vulnerability is not listed in CISA's KEV catalog, so no known active exploits are documented.

Generated by OpenCVE AI on August 22, 2026 at 06:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle Hyperion patch referenced in the Oracle security alert to update to a fixed version.
  • Restrict HTTP access to the Hyperion service to trusted IP ranges or through a VPN to limit potential attackers.
  • If a patch is not immediately deployable, enforce stricter authentication or limit access to the HTTP interface until the patch is applied.

Generated by OpenCVE AI on August 22, 2026 at 06:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Disclosure in Oracle Hyperion Financial Management

Sat, 22 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Confidential Data Disclosure in Oracle Hyperion Financial Management
Weaknesses CWE-284

Sat, 22 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Confidential Data Disclosure in Oracle Hyperion Financial Management
Weaknesses CWE-284

Fri, 21 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Partial Data Disclosure in Oracle Hyperion Financial Management
Weaknesses CWE-200
CWE-285

Wed, 19 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Partial Data Disclosure in Oracle Hyperion Financial Management
Weaknesses CWE-200
CWE-285

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle hyperion Financial Management
CPEs cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Financial Management
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Hyperion Financial Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-22T02:21:49.604Z

Reserved: 2026-08-04T22:06:34.605Z

Link: CVE-2026-70911

cve-icon Vulnrichment

Updated: 2026-08-22T02:21:44.483Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:48.990

Modified: 2026-08-24T15:48:27.917

Link: CVE-2026-70911

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T07:00:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor