Description
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the Security component of Oracle Hyperion Financial Management, enabling a high‑privilege attacker with network access over HTTP to fully compromise the application. A successful exploitation can result in complete takeover of Oracle Hyperion Financial Management, granting the attacker full access to confidential data, the ability to modify or delete information, and potential disruption of availability.

Affected Systems

This issue affects Oracle Corporation’s Hyperion Financial Management product, specifically version 11.2.25.0.000. No other versions are listed as vulnerable.

Risk and Exploitability

The CVSS base score of 7.2 indicates high severity, and the description indicates that the flaw is easily exploitable. The attack vector is network‑based, requiring HTTP access to the affected system and high privileges to succeed. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The potential for a full system takeover remains significant.

Generated by OpenCVE AI on August 24, 2026 at 21:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch for Hyperion Financial Management addressing this vulnerability if available.
  • Restrict HTTP access to Hyperion servers using firewall rules or network segmentation so only trusted internal hosts can reach the application.
  • Enforce strict role‑based access control within Hyperion, removing unnecessary high‑privilege accounts and ensuring only authorized users possess privileged credentials.

Generated by OpenCVE AI on August 24, 2026 at 21:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Title High‑Privilege HTTP Exploit Allows Full Takeover of Oracle Hyperion Financial Management

Mon, 24 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Sun, 23 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Title High‑Privilege HTTP Exploit Allows Full Takeover of Oracle Hyperion Financial Management
Weaknesses CWE-284

Fri, 21 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Title High‑Privilege HTTP Exploitation Enables Full Compromise of Oracle Hyperion Financial Management
Weaknesses CWE-284

Thu, 20 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
Title High‑Privilege HTTP Exploitation Enables Full Compromise of Oracle Hyperion Financial Management
Weaknesses CWE-284

Wed, 19 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Title High-Privilege HTTP Exploit Enables Full Takeover of Oracle Hyperion Financial Management
Weaknesses CWE-284

Wed, 19 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Title High-Privilege HTTP Exploit Enables Full Takeover of Oracle Hyperion Financial Management
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hyperion Financial Management
CPEs cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Financial Management
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Hyperion Financial Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-22T03:12:47.338Z

Reserved: 2026-08-04T22:06:34.607Z

Link: CVE-2026-70939

cve-icon Vulnrichment

Updated: 2026-08-22T03:12:42.980Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:51.997

Modified: 2026-08-24T18:37:59.693

Link: CVE-2026-70939

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T21:45:03Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control