Executive brief
Oracle Hyperion Financial Management is an enterprise financial planning and consolidation system used by large organizations for budgeting, forecasting, and financial close operations. A vulnerability in its Security component allows a low-privileged user with network access to gain complete control of the application, potentially exposing sensitive financial data and enabling unauthorized modifications to critical financial records and systems.
Technical details
A privilege escalation vulnerability exists in the Security component of Oracle Hyperion Financial Management version 11.2.26.0.000. The flaw is exploitable by low-privileged attackers with network access via HTTP, requiring no user interaction. Successful exploitation results in complete compromise of the application with high impacts to confidentiality, integrity, and availability. The vulnerability is easily exploitable (low complexity, low privilege requirement) and allows an attacker to take over the entire Hyperion Financial Management instance. No patch information is currently available from the reference sources.
Affected products
- Oracle Hyperion Financial Management 11.2.26.0.000
Timeline
- 2026-09-15: disclosed