Executive brief
Oracle Hyperion Financial Management is a widely-used enterprise financial planning and management system. A vulnerability in its security component allows a high-privileged attacker with local access to the server to gain complete control of the application, potentially compromising all financial data and reporting capabilities within the system.
Technical details
The vulnerability is an easily exploitable privilege escalation affecting Oracle Hyperion Financial Management version 11.2.26.0.000 in the Security component. It requires high privilege and local access (attack vector: local) with no user interaction needed. Successful exploitation results in complete compromise of the application, allowing an attacker to take over the system and impact confidentiality, integrity, and availability. Patch status is not explicitly confirmed in the advisory.
Affected products
- Oracle Hyperion Financial Management 11.2.26.0.000
Timeline
- 2026-09-15: disclosed