Description
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an easily exploitable SQL injection flaw in the security component of Oracle Hyperion Financial Management. A low-privileged attacker who can send SQL commands over the network can walk into the application and ultimately gain full control of the system, compromising confidentiality, integrity, and availability of the platform.

Affected Systems

Oracle Hyperion Financial Management version 11.2.25.0.000 is affected. Because the flaw causes a change of scope, the compromise could extend to other products that interact with Hyperion.

Risk and Exploitability

With a CVSS 3.1 base score of 9.9, this vulnerability is critical. The EPSS score is < 1%, indicating a very low but non-zero exploitation probability. The issue is not listed in the CISA KEV catalog. The advisory indicates a low-privileged attacker with network access can exploit the SQL injection in the security component to gain full control of the system, compromising confidentiality, integrity, and availability.

Generated by OpenCVE AI on August 22, 2026 at 06:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Hyperion Financial Management security patch or upgrade to a version that resolves CVE-2026-70920.
  • Limit network exposure of the Hyperion platform by configuring firewalls or VPNs so that only trusted IP ranges can reach the SQL interface.
  • Restrict the SQL privileges of low-privileged users and disable any unnecessary administrative or write access accounts.

Generated by OpenCVE AI on August 22, 2026 at 06:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Title SQL Injection in Oracle Hyperion Financial Management Enables Full System Compromise

Sat, 22 Aug 2026 05:15:00 +0000

Type Values Removed Values Added
Title SQL Injection in Oracle Hyperion Financial Management Enables Remote Code Execution
Weaknesses CWE-89

Sat, 22 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 03:45:00 +0000

Type Values Removed Values Added
Title SQL Injection in Oracle Hyperion Financial Management Enables Remote Code Execution
Weaknesses CWE-89

Thu, 20 Aug 2026 09:45:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Remote Code Execution via SQL Injection in Oracle Hyperion Financial Management
Weaknesses CWE-89

Wed, 19 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Remote Code Execution via SQL Injection in Oracle Hyperion Financial Management
Weaknesses CWE-89

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hyperion Financial Management
CPEs cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Financial Management
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Hyperion Financial Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-22T02:31:34.609Z

Reserved: 2026-08-04T22:06:34.606Z

Link: CVE-2026-70920

cve-icon Vulnrichment

Updated: 2026-08-22T02:31:29.185Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:49.810

Modified: 2026-08-24T15:46:14.020

Link: CVE-2026-70920

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T07:00:07Z

Weaknesses