Description
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data and unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).
Published: 2026-08-18
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A weakness in the Security component of Oracle Hyperion Financial Management 11.2.25.0.000 permits a low-privileged attacker with network access over HTTP to trigger application hangs and crashes, and to read, update, or delete data that should be protected. The flaw can lead to denial of service and unauthorized data tampering or disclosure, affecting confidentiality, integrity, and availability.

Affected Systems

Oracle Corporation’s Hyperion Financial Management product, version 11.2.25.0.000, is impacted; no other Oracle products or versions are mentioned as affected.

Risk and Exploitability

The CVSS v3.1 base score of 6.4 indicates a moderate severity. An EPSS score of <1% shows a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack can be carried out over the network through the HTTP interface, requiring only low privileges and high attack complexity, resulting in a moderate risk of moderate impact.

Generated by OpenCVE AI on August 24, 2026 at 20:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch or update released by Oracle for version 11.2.25.0.000.
  • If a patch is not yet available, restrict HTTP access to the application to trusted networks only using firewall rules or network segmentation.
  • Enforce strict role‑based access controls and review user permissions to ensure they align with audit policies.
  • Monitor application logs for unexpected hangs, crashes, or unauthorized data operations, and set alerts for high‑severity events.

Generated by OpenCVE AI on August 24, 2026 at 20:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Fri, 21 Aug 2026 03:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Enables DoS and Unauthorized Data Access in Oracle Hyperion Financial Management

Thu, 20 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Title HTTP DoS and Data Access Vulnerability in Oracle Hyperion Financial Management
Weaknesses CWE-200
CWE-285
CWE-399

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Title HTTP DoS and Data Access Vulnerability in Oracle Hyperion Financial Management
Weaknesses CWE-200
CWE-285
CWE-399

Wed, 19 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Title Denial of Service and Unauthorized Data Modification via HTTP in Oracle Hyperion Financial Management 11.2.25.0.000
Weaknesses CWE-284
CWE-400

Wed, 19 Aug 2026 05:15:00 +0000

Type Values Removed Values Added
Title Denial of Service and Unauthorized Data Modification via HTTP in Oracle Hyperion Financial Management 11.2.25.0.000
Weaknesses CWE-284
CWE-400

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data and unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).
First Time appeared Oracle
Oracle hyperion Financial Management
CPEs cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Financial Management
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Oracle Hyperion Financial Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-20T18:00:23.204Z

Reserved: 2026-08-04T22:06:34.616Z

Link: CVE-2026-71090

cve-icon Vulnrichment

Updated: 2026-08-20T17:47:27.500Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:09.200

Modified: 2026-08-24T18:25:31.080

Link: CVE-2026-71090

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T20:30:07Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control