Executive brief
Oracle Hyperion Financial Management is a widely-used financial planning and consolidation system. This vulnerability allows a low-privileged attacker with network access to execute arbitrary SQL commands, potentially compromising the entire system including confidentiality, integrity, and availability of financial data across connected products.
Technical details
This is a SQL injection vulnerability in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. The vulnerability is easily exploitable via network access and requires only low privilege credentials (no special authentication). Successful exploitation allows an attacker to execute arbitrary SQL commands against the underlying database, achieving full system compromise. The scope is noted as changed, meaning attacks on this component can significantly impact other connected Oracle products. A patch is expected from Oracle.
Affected products
- Oracle Hyperion Financial Management 11.2.25.0.000
Timeline
- 2026-08-18: disclosed