Description
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the security component of Oracle Hyperion Financial Management. A low‑privileged attacker who can reach the system over HTTP can exploit this flaw to compromise the application, resulting in a full takeover with complete confidentiality, integrity, and availability loss.

Affected Systems

Affected Vendor: Oracle Corporation. Product: Oracle Hyperion Financial Management, version 11.2.25.0.000. No other versions are listed as affected.

Risk and Exploitability

The CVSS 3.1 base score of 7.5 indicates high risk. With an attack vector of network and minimal privileges, the exploit could be performed remotely by an attacker who can send HTTP requests to the application. The EPSS score is < 1%, and the vulnerability is not in CISA KEV, but the high impact warrants prompt attention. A likely attack path involves sending crafted requests to the vulnerable component over HTTP, bypassing normal authorization controls.

Generated by OpenCVE AI on August 24, 2026 at 20:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest version or patch released by Oracle for Hyperion Financial Management that addresses the security component vulnerability.
  • Restrict HTTP access to the Hyperion instance to only trusted internal networks or VPN, and block public access.
  • Enforce strong authentication and role-based access controls, ensuring that users have only the minimal privileges required.

Generated by OpenCVE AI on August 24, 2026 at 20:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Title Low‑Privileged HTTP Access Enables Full Takeover of Oracle Hyperion Financial Management

Mon, 24 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Fri, 21 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
Title Low‑Privileged HTTP Access Enables Full Takeover of Oracle Hyperion Financial Management

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Title Remote takeover via low privileged HTTP access in Oracle Hyperion Financial Management
Weaknesses CWE-284

Wed, 19 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Title Remote takeover via low privileged HTTP access in Oracle Hyperion Financial Management
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hyperion Financial Management
CPEs cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Financial Management
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Hyperion Financial Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-20T17:20:12.727Z

Reserved: 2026-08-04T22:06:34.607Z

Link: CVE-2026-70946

cve-icon Vulnrichment

Updated: 2026-08-20T16:09:56.463Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:52.817

Modified: 2026-08-24T18:25:39.903

Link: CVE-2026-70946

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T21:00:13Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control