Description
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-08-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in the Security component of Oracle Hyperion Financial Management allows an attacker with low privileges and network access via SQL to execute statements that create, delete or modify critical data. The flaw can also be used to read protected data, effectively giving the attacker unauthorized access to all information the application permits. The primary impact is loss of data integrity and confidentiality. No arbitrary code execution is disclosed.

Affected Systems

Oracle Hyperion Financial Management, version 11.2.25.0.000, provided by Oracle Corporation.

Risk and Exploitability

The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with a low complexity attacker effort. The EPSS score is below 1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack path involves SQL injection over the network into the application’s database interface, requiring only a user account with limited privileges. The scope is limited to the affected product version; later releases are presumed patched.

Generated by OpenCVE AI on August 22, 2026 at 06:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch or product update that addresses CVE-2026-70925
  • Restrict database access to only necessary application accounts and enforce least privilege
  • Implement input validation and parameterized queries to prevent SQL injection
  • Disable or limit exposed SQL interfaces to external users when possible

Generated by OpenCVE AI on August 22, 2026 at 06:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 07:00:00 +0000

Type Values Removed Values Added
Title Low Privilege SQL Injection Enables Data Modification and Disclosure in Oracle Hyperion Financial Management

Sat, 22 Aug 2026 05:15:00 +0000

Type Values Removed Values Added
Title SQL Injection in Oracle Hyperion Financial Management Enables Data Modification and Disclosure
Weaknesses CWE-89

Sat, 22 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title SQL Injection in Oracle Hyperion Financial Management Enables Data Modification and Disclosure
Weaknesses CWE-89

Wed, 19 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege SQL Injection in Oracle Hyperion Financial Management Allows Unauthorized Data Modification
Weaknesses CWE-89

Wed, 19 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege SQL Injection in Oracle Hyperion Financial Management Allows Unauthorized Data Modification
Weaknesses CWE-89

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle hyperion Financial Management
CPEs cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Financial Management
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Hyperion Financial Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-22T02:41:11.853Z

Reserved: 2026-08-04T22:06:34.606Z

Link: CVE-2026-70925

cve-icon Vulnrichment

Updated: 2026-08-22T02:41:06.895Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:50.393

Modified: 2026-08-24T15:45:35.250

Link: CVE-2026-70925

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T06:45:04Z

Weaknesses