Executive brief
Oracle Hyperion Financial Management is a financial planning and consolidation system used by enterprises to manage budgets and close accounts. A vulnerability in the security component allows an attacker with local access to the infrastructure to read a subset of sensitive financial data without proper authentication. This could expose confidential financial information, including budgets, forecasts, and consolidation data.
Technical details
The vulnerability is an unauthorized information disclosure flaw in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The attack requires local access to the infrastructure where the product executes, with no authentication or user interaction needed. An attacker with logon capability to the host system can exploit this to gain read access to a subset of the application's data. The vulnerability results in confidentiality impact only (no integrity or availability impact). A patch is expected to be available through Oracle's regular security update process.
Affected products
- Oracle Hyperion Financial Management 11.2.25.0.000
Timeline
- 2026-08-18: disclosed