Hyperion Financial Management
Monthly
Full compromise of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, targeting the Security component to gain complete control over confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 reflects the combination of network accessibility, low attack complexity, and no user interaction required beyond a valid low-privilege account. No public exploit code or CISA KEV listing has been identified at time of analysis, though the severity of the stated outcome - full system takeover - warrants immediate patch application.
Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker exploiting a flaw in the Security component, with confirmed scope change enabling impact on additional adjacent products. The CVSS vector (AV:L/AC:H/PR:H) reflects a difficult-to-exploit, infrastructure-local attack requiring significant access prerequisites, yet successful exploitation yields complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is best understood as an insider or post-compromise escalation threat rather than an opportunistic remote attack.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a Security component flaw - tagged as an authentication bypass - that enables low-privileged authenticated attackers to gain complete read access to all data within the application and limited write access, with a confirmed scope change extending impact to additional Oracle Hyperion suite products. Exploitation requires human interaction from a victim but carries low attack complexity and is reachable over HTTP without elevated privileges. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is possible via a network-accessible HTTP attack against the Security component. The CVSS vector confirms no authentication, no user interaction, and no special conditions are required, placing this squarely in the high-severity, easily exploitable category. Successful exploitation yields complete read access to all data accessible by the application and a partial denial of service, making this a critical risk for financial institutions running the affected build. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by a network-accessible, high-privileged attacker exploiting a flaw in the Security component via HTTP. The vulnerability carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, amounting to effective product compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and complete CIA triad impact warrant prompt remediation attention.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker targeting the Security component over HTTP, resulting in complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 7.5 (High) reflects this total impact, though high attack complexity (AC:H) constrains opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS data was supplied in the source intelligence.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker via TCP, with no user interaction required. The vulnerability resides in the Security component and results in complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible lateral-movement risk in enterprise financial environments.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 allows unauthenticated, network-adjacent attackers to fully read and manipulate sensitive financial consolidation data without any credentials. The affected component is HFM's Security subsystem, and exploitation requires only adjacency to the physical or logical network segment hosting the application - no user interaction or privileges needed. No public exploit code and no CISA KEV listing exist at time of analysis, though the low attack complexity makes this straightforward to exploit for any attacker achieving network adjacency.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged network attackers to bypass security controls and gain complete access to sensitive financial data via HTTP. Tagged as an Authentication Bypass in EUVD-2026-61889, the flaw carries a CVSS scope change indicator meaning successful exploitation can extend confidentiality impacts to additional Oracle Hyperion products sharing the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's own designation of this as 'easily exploitable' and the low attack complexity are meaningful risk signals for organizations running this financial consolidation platform.
Full system takeover is achievable in Oracle Hyperion Financial Management 11.2.25.0.000 through a flaw in its Security component, exploitable over HTTP by any low-privileged attacker with network access and no required user interaction. The CVSS 3.1 score of 8.8 reflects complete high-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Hyperion Financial Management 11.2.25.0.000 contains a flaw in its Security component that allows a high-privileged, network-authenticated attacker to achieve full system takeover via HTTP, impacting confidentiality, integrity, and availability. Disclosed via Oracle's August 2026 Critical Security Patch Update (CSPU) and corroborated by EUVD-2026-61886, the attack requires no user interaction and has low complexity once privileged credentials are available. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-authenticated attacker exploiting a flaw in its Security component via HTTP. The vulnerability demands high attack complexity - indicating specific conditions must align - but successful exploitation yields complete compromise of confidentiality, integrity, and availability, consistent with a privilege escalation or security bypass in the access-control subsystem. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed this through the August 2026 Critical Patch Update.
Local authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with infrastructure logon to read and modify all application-accessible financial data. The CVSS 7.1 score reflects high confidentiality and integrity impact with no availability disruption, constrained entirely to the local attack surface. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data exfiltration and partial service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per the 'Authentication Bypass' tag, likely involves improper enforcement of access controls that permits a low-privileged user to read data far beyond their authorization level, achieving complete access to all Financial Management accessible data (C:H). No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to leverage for any authenticated user of the application.
Unauthorized data access and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 are achievable by any low-privileged, network-connected attacker via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per vendor-assigned tags, involves an authentication bypass mechanism that elevates effective access beyond the attacker's granted privileges, enabling exposure of critical financial data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog; however, the low attack complexity and broad network exposure make it a high-priority remediation target for organizations running the affected release.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all financial data accessible within the application and degrade service availability via HTTP. The 'Authentication Bypass' tag suggests the Security component vulnerability enables privilege escalation beyond the attacker's granted role, exposing sensitive financial consolidation data. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, network accessibility, and high confidentiality impact against enterprise financial data makes this a meaningful priority for affected organizations.
Oracle Hyperion Financial Management 11.2.25.0.000 contains an authentication bypass in its Security component that allows a low-privileged authenticated attacker to exceed their authorized access over HTTP, resulting in full confidentiality and integrity compromise of all application data. The flaw enables unauthorized read access to sensitive corporate financial records as well as creation, deletion, or modification of critical data across the entire HFM instance. No public exploit has been identified at time of analysis, and Oracle addressed this vulnerability in the Critical Patch Update for August 2026.
Full system takeover is possible in Oracle Hyperion Financial Management 11.2.25.0.000 through the Security component, exploitable via SQL by a low-privileged network attacker with no user interaction required. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and full-takeover impact elevate real-world risk for any organization running the affected version.
SQL-layer exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged network attacker to fully compromise data confidentiality and integrity across all accessible financial data. The flaw resides in the Security component, and successful exploitation permits unauthorized read, creation, deletion, and modification of critical data - a particularly severe outcome for an EPM platform handling sensitive financial consolidation records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a high-priority patch target for any Oracle EPM deployment.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthenticated attacker reach the application over TLS and read or alter all data the product can access, with a scope-changing blast radius into adjacent Oracle products. Rated CVSS 10.0, it is trivially exploitable (AV:N/AC:L/PR:N/UI:N) and delivers full confidentiality and integrity compromise while leaving availability untouched. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the perfect score and unauthenticated network reach make it a top-priority patch.
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a low-privileged attacker with network access, operating over the SQL layer, fully compromise the application and - because of a scope change - significantly impact other connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact. No public exploit code has been identified and it is not on CISA KEV, but the low complexity and low privilege bar make it a top-priority patch item.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local-access vulnerability in its Security component that allows an unauthenticated local attacker to achieve full system takeover - compromising confidentiality, integrity, and availability - when combined with required interaction from a separate legitimate user. The attack is constrained to actors with logon access to the infrastructure hosting HFM and requires high complexity to execute, limiting the realistic threat population to insiders or those who have already established a foothold on the target server. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated remote exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 exposes the Security component to authentication bypass via HTTP, enabling attackers to read critical or all accessible financial data and inflict a partial denial of service. The vulnerability is rated CVSS 8.2 (High) with a low-complexity, network-accessible attack vector requiring no privileges or user interaction. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the authentication bypass tag and unauthenticated attack surface make this a meaningful priority for any organization running the affected version.
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allow a remote, unauthenticated attacker to reach the application over HTTP and create, modify, or delete critical data as well as trigger a complete, repeatable crash. Oracle rates this CVSS 9.1 (I:H/A:H, no confidentiality impact), reflecting an easily exploitable network-facing flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch item.
Local privilege escalation with scope change in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged authenticated user on the host system to bypass security controls within the Security component, achieving complete unauthorized read and write access to all application data. The CVSS scope change (S:C) means successful exploitation can cascade into additional Oracle products sharing the same infrastructure, amplifying the blast radius beyond the immediate application. No public exploit code or CISA KEV listing exists at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.25.0.000 enables low-privileged authenticated host users to fully compromise the application's confidentiality and data integrity via a flaw in the Security component. Critically, the CVSS scope change indicator (S:C) signals that successful exploitation may cascade beyond the HFM application boundary to impact additional co-hosted Oracle products. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of required user interaction make exploitation straightforward for any attacker holding a valid local system account.
Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged attacker with HTTP network access, exploiting a flaw in the Security component. Oracle's own description characterizes the outcome as complete compromise, with CVSS 3.1 confirming full confidentiality, integrity, and availability impact (C:H/I:H/A:H), making this more severe than the accompanying 'Information Disclosure' tag suggests. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable via HTTP due to a failure in the Security component's authentication enforcement. Tagged as an authentication bypass, the flaw allows any network-reachable attacker with no credentials or user interaction to access all data within the application's scope, carrying a CVSS 3.1 score of 7.5 (High) reflecting complete confidentiality compromise. No public exploit code or confirmed active exploitation has been identified at the time of analysis, though the low attack complexity lowers the practical barrier for capable adversaries who can reach the service.
Complete data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a network-accessible, low-privileged authenticated attacker to bypass security controls within the application's Security component and gain unauthorized read access to all data the application can reach. The scope change (S:C) in the CVSS vector signals that successful exploitation may expose data beyond the HFM instance itself, potentially impacting other integrated Oracle Hyperion suite components. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity and the Authentication Bypass tag make this a practical risk for any organization running this CPM platform.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 exposes critical financial data to unauthenticated network attackers via HTTPS. The Security component flaw - tagged explicitly as an authentication bypass by Oracle - allows complete read and write access to all data within the application, including sensitive financial consolidation records. No public exploit or CISA KEV listing is confirmed at time of analysis, and the high attack complexity (AC:H) limits opportunistic mass exploitation, but the unauthenticated network vector and dual high-severity impact on both confidentiality and integrity make this a serious priority for organizations running this version.
Unauthenticated remote information disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes the complete data set accessible to the application via HTTP. The Security component contains an authentication bypass weakness that allows a network-adjacent attacker with no credentials to retrieve critical financial data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to target.
Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-authenticated attacker via the SQL interface targeting the Security component, with successful exploitation yielding complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 8.8 reflects low attack complexity and no user interaction required, making exploitation straightforward for any attacker holding valid low-level credentials. No public exploit code has been identified and no CISA KEV listing is present at time of analysis, though the low barrier to exploitation warrants urgent patching for organizations running this version.
Oracle Hyperion Financial Management 11.2.25.0.000 is vulnerable to full system takeover via a SQL-based attack against its Security component, exploitable by any low-privileged network-authenticated user. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability with no user interaction required beyond holding basic credentials. Oracle disclosed this as part of its August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL-based network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged authenticated attacker to fully compromise the application, achieving complete confidentiality, integrity, and availability impact. The vulnerability resides in the Security component and is exploitable with low attack complexity and no user interaction required, making it a reliable attack path for any threat actor holding valid credentials. No public exploit code or active exploitation has been identified at time of analysis.
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated attacker with HTTP network access to fully compromise the application. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and per the CVSS vector requires no privileges or user interaction, making it a prime candidate for opportunistic exploitation. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; despite the Oracle-supplied 'Information Disclosure' tag, the CVSS I:H/A:H metrics and 'takeover' language indicate impact well beyond disclosure.
Unauthenticated remote exploitation of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows network attackers to obtain complete access to all financial reporting data and cause a partial denial of service via HTTPS. The vulnerability resides in the Server component and is tagged as an authentication bypass, meaning no credentials are required to trigger the flaw against a network-exposed instance. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch target for any organization running this specific version.
Unauthenticated remote access to sensitive financial data is possible in Oracle Hyperion Financial Reporting version 11.2.25.0.000 via an authentication bypass in its Server component, exploitable over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no interaction, and no special configuration is required - making this trivially exploitable from any network-reachable position. Impact is limited to confidentiality, but the data exposed (financial reporting data) carries significant business and regulatory risk. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local privilege-assisted attack in its Security component, allowing a low-privileged authenticated user who can log on to the host infrastructure to partially compromise confidentiality, integrity, and availability. The attack demands high complexity and requires interaction from a secondary human actor, placing it firmly in the category of difficult, opportunistic local exploitation. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Oracle via the August 2026 Critical Security Patch Update.
Unauthenticated read-access exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows remote attackers to retrieve a subset of application data via HTTP without any credentials. The flaw resides in the Security component and is tagged as an Authentication Bypass, meaning the component fails to enforce proper access controls on at least one HTTP-accessible endpoint. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the trivial attack conditions (AC:L/PR:N/UI:N) lower the bar for opportunistic reconnaissance.
Partial integrity and availability compromise in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over HTTP, provided high attack complexity conditions are met and a victim user interacts during the attack. Successful exploitation allows unauthorized modification or deletion of a subset of accessible data and can cause a partial denial of service. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local availability vulnerability in its Security component, allowing a high-privileged attacker already logged on to the host infrastructure to cause a partial denial of service. The attack is difficult to execute, requires existing elevated local access, and results only in limited availability degradation with no confidentiality or integrity impact. No public exploit or active exploitation has been identified; CVSS 3.1 Base Score is 1.9, placing this among the lowest-severity tracked vulnerabilities.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a network-accessible vulnerability in its Security component that allows a low-privileged, authenticated attacker to partially compromise data confidentiality and integrity across product boundaries via HTTP. Exploitation requires both high attack complexity and victim interaction, limiting opportunistic exploitation but not eliminating targeted risk in enterprise financial environments. No public exploit code has been identified at time of analysis, and the vulnerability is tagged as an Authentication Bypass by the reporting source, suggesting the Security component may fail to enforce authorization boundaries under specific conditions.
Local privilege abuse in Oracle Hyperion Financial Management 11.2.25.0.000 allows a high-privileged attacker with logon access to the host infrastructure to read a subset of accessible data and perform unauthorized insert, update, or delete operations against that data. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 3.0, reflecting its constrained local attack vector, high complexity, and high privilege prerequisites. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthorized data access and modification in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, contingent on human interaction from a victim. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, enabling partial confidentiality and integrity compromise without attacker credentials. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, but the low attack complexity and zero privilege requirement make social-engineering-assisted attacks practical against exposed instances.
Unauthenticated network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 enables remote attackers to perform unauthorized data manipulation and cause partial denial of service via HTTP against the Security component. The vulnerability requires no credentials and no user interaction, making it trivially accessible to any attacker with network reach to the application. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis; however, the unauthenticated, network-accessible attack surface warrants prompt patching.
Denial-of-service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-adjacent attacker to cause the application to hang or crash repeatedly via crafted HTTP requests targeting the Security component. The flaw is rated Medium (CVSS 5.3) due to high attack complexity, meaning exploitation requires specific conditions to be met beyond simply having network access. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged attacker with local logon access to the host infrastructure, exploiting a flaw in the Security component under conditions of high attack complexity. Despite a moderate CVSS base score of 6.4 - dampened by strict access prerequisites - successful exploitation yields complete confidentiality, integrity, and availability compromise of the application. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes an authentication bypass in its Security component that permits unauthenticated network attackers to perform limited unauthorized read and write operations on accessible financial data via HTTP. The attack is classified as difficult to exploit (AC:H), constraining realistic risk despite the absence of any authentication requirement. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.
Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker targeting the Security component, resulting in complete compromise of confidentiality, integrity, and availability. The attack requires logon access to the infrastructure host where the application runs, limiting exposure to insider threats or attackers who have already established a foothold with elevated privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the local-only attack vector substantially constrains real-world risk despite the full CIA impact.
Confidentiality breach in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible within the application via HTTP, including sensitive financial consolidation records. The vulnerability resides in the Security component and carries an 'Authentication Bypass' classification, suggesting improper enforcement of authorization controls that permits privilege escalation beyond the attacker's intended access level. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high attack complexity requirement indicates exploitation demands specific environmental or application-state conditions.
Local denial-of-service in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with logon access to the hosting infrastructure to hang or repeatedly crash the application via its Security component. The CVSS vector confirms this is a local, high-complexity attack with no confidentiality or integrity impact - purely an availability concern. No public exploit code and no CISA KEV listing exist at time of analysis, and the combination of local access requirement and high attack complexity substantially limits opportunistic exploitation.
Partial unauthorized data access and service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 can be achieved by low-privileged, network-accessible attackers via HTTP targeting the Security component. Exploitation allows unauthorized read of a subset of application data, unauthorized update or insert of accessible data, and partial denial of service - all without user interaction. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
SQL-based exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 enables a high-privileged authenticated attacker to achieve complete read and write access to all financial data within the application. The Security component - the logical gatekeeper for data authorization - is the attack surface, and successful exploitation grants unauthorized creation, deletion, modification, and disclosure of critical financial records. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the 'Authentication Bypass' tag warrants scrutiny given the contradiction with the PR:H CVSS metric (see risk assessment).
Hyperion Financial Management version 11.2.25.0.000 exposes authenticated low-privileged network attackers to a tri-impact vulnerability in its Security component: complete, repeatable denial of service via application hang or crash, limited unauthorized data modification, and partial unauthorized data disclosure. Exploitation requires a valid low-privileged account, HTTP network access, and conditions of high attack complexity - factors that collectively reduce the likelihood of opportunistic or automated attack. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthorized access to all data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged remote attacker exploiting a flaw in the Security component over HTTP. The vulnerability results in complete confidentiality compromise - an attacker can read all data accessible to the application, including sensitive financial consolidation records. No public exploit has been identified at time of analysis, and exploitation is bounded by the requirement for high-privilege credentials, though the 'Authentication Bypass' tag suggests established access may allow security control circumvention beyond the attacker's normal authorization scope.
Unauthorized confidential data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes complete application-accessible data to a network-based attacker already holding high-level privileges, exploiting a flaw within the Security component via HTTP. EUVD metadata tags this as an Authentication Bypass, suggesting an access-control enforcement failure that allows an authenticated high-privileged user to exceed authorized data boundaries rather than a perimeter bypass open to unauthenticated parties. No public exploit code has been identified, and the vulnerability has not appeared in CISA KEV at time of analysis; the high attack complexity further constrains realistic exploitation.
Unauthorized access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by any low-privileged, network-authenticated attacker over HTTP. The flaw resides in the Security component and, per the Oracle tag classification, represents an authorization bypass that permits a low-privilege account to read critical or complete HFM data assets well beyond their assigned permissions. No public exploit has been identified at time of analysis, though Oracle's Critical Security Update for August 2026 formally acknowledges and patches the issue.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged attacker with network access via HTTP to bypass security controls and gain complete read access to all data accessible within the application. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating weaknesses in how the application enforces authorization for authenticated sessions. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the confidentiality impact is rated High, covering critical financial consolidation data.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows any low-privileged authenticated attacker with HTTP network access to bypass security controls within the Security component, gaining read access to all financial data accessible by the application. Tagged as an Authentication Bypass, this suggests low-privileged users can circumvent authorization logic to access data sets beyond their permitted scope. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor's 'easily exploitable' designation and low attack complexity make this a practical risk for organizations running HFM in financial consolidation environments.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 enables low-privileged authenticated users to access critical financial data or all application-accessible data over HTTP. The vulnerability resides in the Security component, and the 'Authentication Bypass' tag in the intelligence data suggests a breakdown in authorization enforcement that allows an authenticated low-privileged user to exceed their intended access scope - effectively escalating read access to sensitive financial records. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and network accessibility make this a practical risk for any organization relying on HFM for financial consolidation.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a low-severity integrity flaw in its Security component that permits a local, unauthenticated attacker - one with OS-level logon to the host infrastructure - to perform unauthorized insert, update, or delete operations against a subset of accessible application data. Exploitation is rated difficult (AC:H) and additionally requires human interaction from a party other than the attacker, substantially constraining real-world opportunity. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, consistent with its 2.5 CVSS base score.
Local authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 exposes a subset of sensitive financial data to unauthenticated local attackers via the Security component. The vulnerability is tagged as an authentication bypass and carries a CVSS 3.1 score of 4.0, reflecting limited confidentiality impact with no integrity or availability consequences. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease-of-exploitation characterization in Oracle's advisory warrants prompt patching in environments where infrastructure access is not tightly controlled.
Hyperion Financial Management version 11.2.25.0.000 contains an authentication bypass in its Security component that allows unauthenticated local attackers to read a subset of application-accessible financial data. The attack vector is strictly local (AV:L), meaning exploitation requires logon access to the host OS infrastructure where Hyperion executes - this is not a remotely triggerable flaw. No public exploit code has been identified at time of analysis, and the CVSS base score of 4.0 reflects limited, confidentiality-only impact with no integrity or availability consequences.
Integrity compromise in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged local attacker - contingent on human interaction from a separate user - to perform unauthorized creation, deletion, or modification of critical financial consolidation data, with potential scope change impact on additional Oracle components. ENISA EUVD-2026-61861 tags this as involving Authentication Bypass within the Security component, though the specific mechanism is not disclosed in Oracle's advisory. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Unauthorized read access to Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP, exploiting a flaw in the product's Security component tagged as an authentication bypass. The CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, zero-privilege exploitation with no user interaction required, limited to partial confidentiality loss. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, placing this in the moderate-priority remediation category despite the sensitivity of financial consolidation data.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity, network-accessible vulnerability in its Security component that allows a high-privileged, authenticated attacker to read a limited subset of application data and cause a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 (Low) accurately reflects the constrained real-world risk: exploitation demands both elevated privileges and high attack complexity, substantially limiting the attacker population. No public exploit code or active exploitation has been identified at time of analysis.
Partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, authenticated attacker over HTTP, targeting the Security component under high-complexity conditions. Impact is limited exclusively to availability - no confidentiality or integrity compromise is possible - resulting in a partial service disruption rather than full outage. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing it at low real-world priority for most environments.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity local vulnerability in its Security component, enabling a high-privileged attacker with local infrastructure logon to perform unauthorized data modification and cause partial denial of service. The CVSS vector (AV:L/AC:H/PR:H) confirms that exploitation requires both physical or logical local access and a high-privilege account, with complex attack conditions that must be met. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, consistent with its low base score and restricted attack surface.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a network-exploitable vulnerability in its Security component that allows a high-privileged authenticated attacker to exfiltrate critical financial data or cause a complete denial of service via crafted HTTP requests. Disclosed as part of Oracle's Critical Patch Update for August 2026 (CSPUAUG2026), this flaw carries a CVSS 3.1 base score of 6.5, driven by High confidentiality and High availability impacts with no integrity effect. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence data introduces a notable ambiguity regarding actual privilege requirements that warrants verification.
Partial confidentiality exposure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows unauthenticated network attackers to read a subset of application data via HTTP under high-complexity conditions. The Security component is tagged as an authentication bypass, though impact is limited to low-severity data disclosure with no integrity or availability consequences. No public exploit code or CISA KEV listing exists at time of analysis.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local privilege escalation via its Security component, enabling a low-privileged infrastructure user to bypass access controls and obtain complete unauthorized access to all financial data the application can reach. The CVSS scope change (S:C) confirms that successful exploitation extends impact beyond HFM itself to additional Oracle ecosystem products sharing the same infrastructure. No public exploit has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables an unauthenticated attacker positioned on the same physical network segment to fully compromise confidentiality and integrity of financial data. The vulnerability is tagged as an authentication bypass in the Security component, meaning an adversary can bypass credential checks and gain unauthorized read and write access to all financial data accessible by the application. No public exploit code has been identified at time of analysis, and the adjacent-network vector combined with high attack complexity limits the realistic attacker population to internal network adversaries or those with network proximity to the deployment.
Local confidentiality breach in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged infrastructure user to bypass Security component controls and gain unauthorized access to critical financial data, with potential spillover into additional connected Oracle products due to a confirmed scope change. The CVSS vector (AV:L/AC:H/PR:L/S:C/C:H) indicates the attack requires local system logon and high complexity, but successful exploitation yields complete read access to all data accessible by the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world immediate risk moderate despite the authentication bypass tag.
Local access exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 enables authenticated low-privileged users with host logon rights to bypass Security component access controls and gain unauthorized read access to all HFM-accessible financial data, plus limited write capability. The vulnerability is tagged as an Authentication Bypass within the Security component itself - not a peripheral feature - meaning the core authorization enforcement mechanism is circumvented. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and realistic insider-threat scenario make this actionable for organizations running HFM on-premises.
Local confidentiality exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged attacker with local system logon to read critical or all accessible financial data within the application. The vulnerability resides in the Security component and is classified as easily exploitable given low attack complexity and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to gain complete read access to all data accessible by the application via HTTP. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, indicating that an attacker with a valid but low-privileged account can circumvent authorization controls to read critical financial data beyond their intended scope. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network attack vector make this straightforward to exploit once credentials are obtained.
Unauthorized data disclosure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows low-privileged, network-based attackers to access critical or complete application data via HTTP. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating that existing authorization controls can be circumvented by an attacker holding any low-privilege account, exposing all financial data accessible within the application. No public exploit code has been identified at time of analysis, and Oracle has addressed the issue in its Critical Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to access all data accessible to the application via HTTP, targeting the Security component. The 'Authentication Bypass' tag suggests an authorization control failure permitting privilege escalation within an authenticated session, enabling full confidentiality compromise of sensitive financial consolidation data. No public exploit or active exploitation has been identified; this was disclosed as part of Oracle's Critical Security Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a network-accessible low-privileged attacker to read all data the application can access via a flaw in its Security component over HTTP. The vulnerability is tagged as an authentication bypass, suggesting that while a low-privilege session is sufficient to initiate the attack, the Security component fails to enforce authorization boundaries that should restrict access to higher-privilege data. No public exploit code has been identified and no active exploitation is confirmed by CISA KEV at the time of analysis.
Unauthenticated remote compromise of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows network-adjacent attackers to read a subset of financial reporting data and perform unauthorized insert, update, or delete operations against Repository data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) combined with the 'Authentication Bypass' tag confirms that no credentials are required and exploitation is straightforward against exposed instances. No patch bypass, public exploit code, or CISA KEV listing has been identified at time of analysis, though Oracle classifies this as 'easily exploitable.'
Vulnerability in the Hyperion Financial Management product of Oracle Hyperion (component: Task Automation). Rated low severity (CVSS 3.9), this vulnerability is remotely exploitable.
Vulnerability in the Hyperion Financial Management product of Oracle Hyperion (component: Security). Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable. No vendor patch available.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: OAM). Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104 allows remote attackers to execute arbitrary code via unknown vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Full compromise of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, targeting the Security component to gain complete control over confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 reflects the combination of network accessibility, low attack complexity, and no user interaction required beyond a valid low-privilege account. No public exploit code or CISA KEV listing has been identified at time of analysis, though the severity of the stated outcome - full system takeover - warrants immediate patch application.
Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker exploiting a flaw in the Security component, with confirmed scope change enabling impact on additional adjacent products. The CVSS vector (AV:L/AC:H/PR:H) reflects a difficult-to-exploit, infrastructure-local attack requiring significant access prerequisites, yet successful exploitation yields complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is best understood as an insider or post-compromise escalation threat rather than an opportunistic remote attack.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a Security component flaw - tagged as an authentication bypass - that enables low-privileged authenticated attackers to gain complete read access to all data within the application and limited write access, with a confirmed scope change extending impact to additional Oracle Hyperion suite products. Exploitation requires human interaction from a victim but carries low attack complexity and is reachable over HTTP without elevated privileges. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is possible via a network-accessible HTTP attack against the Security component. The CVSS vector confirms no authentication, no user interaction, and no special conditions are required, placing this squarely in the high-severity, easily exploitable category. Successful exploitation yields complete read access to all data accessible by the application and a partial denial of service, making this a critical risk for financial institutions running the affected build. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by a network-accessible, high-privileged attacker exploiting a flaw in the Security component via HTTP. The vulnerability carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, amounting to effective product compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and complete CIA triad impact warrant prompt remediation attention.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker targeting the Security component over HTTP, resulting in complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 7.5 (High) reflects this total impact, though high attack complexity (AC:H) constrains opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS data was supplied in the source intelligence.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker via TCP, with no user interaction required. The vulnerability resides in the Security component and results in complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible lateral-movement risk in enterprise financial environments.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 allows unauthenticated, network-adjacent attackers to fully read and manipulate sensitive financial consolidation data without any credentials. The affected component is HFM's Security subsystem, and exploitation requires only adjacency to the physical or logical network segment hosting the application - no user interaction or privileges needed. No public exploit code and no CISA KEV listing exist at time of analysis, though the low attack complexity makes this straightforward to exploit for any attacker achieving network adjacency.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged network attackers to bypass security controls and gain complete access to sensitive financial data via HTTP. Tagged as an Authentication Bypass in EUVD-2026-61889, the flaw carries a CVSS scope change indicator meaning successful exploitation can extend confidentiality impacts to additional Oracle Hyperion products sharing the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's own designation of this as 'easily exploitable' and the low attack complexity are meaningful risk signals for organizations running this financial consolidation platform.
Full system takeover is achievable in Oracle Hyperion Financial Management 11.2.25.0.000 through a flaw in its Security component, exploitable over HTTP by any low-privileged attacker with network access and no required user interaction. The CVSS 3.1 score of 8.8 reflects complete high-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Hyperion Financial Management 11.2.25.0.000 contains a flaw in its Security component that allows a high-privileged, network-authenticated attacker to achieve full system takeover via HTTP, impacting confidentiality, integrity, and availability. Disclosed via Oracle's August 2026 Critical Security Patch Update (CSPU) and corroborated by EUVD-2026-61886, the attack requires no user interaction and has low complexity once privileged credentials are available. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-authenticated attacker exploiting a flaw in its Security component via HTTP. The vulnerability demands high attack complexity - indicating specific conditions must align - but successful exploitation yields complete compromise of confidentiality, integrity, and availability, consistent with a privilege escalation or security bypass in the access-control subsystem. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed this through the August 2026 Critical Patch Update.
Local authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with infrastructure logon to read and modify all application-accessible financial data. The CVSS 7.1 score reflects high confidentiality and integrity impact with no availability disruption, constrained entirely to the local attack surface. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data exfiltration and partial service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per the 'Authentication Bypass' tag, likely involves improper enforcement of access controls that permits a low-privileged user to read data far beyond their authorization level, achieving complete access to all Financial Management accessible data (C:H). No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to leverage for any authenticated user of the application.
Unauthorized data access and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 are achievable by any low-privileged, network-connected attacker via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per vendor-assigned tags, involves an authentication bypass mechanism that elevates effective access beyond the attacker's granted privileges, enabling exposure of critical financial data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog; however, the low attack complexity and broad network exposure make it a high-priority remediation target for organizations running the affected release.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all financial data accessible within the application and degrade service availability via HTTP. The 'Authentication Bypass' tag suggests the Security component vulnerability enables privilege escalation beyond the attacker's granted role, exposing sensitive financial consolidation data. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, network accessibility, and high confidentiality impact against enterprise financial data makes this a meaningful priority for affected organizations.
Oracle Hyperion Financial Management 11.2.25.0.000 contains an authentication bypass in its Security component that allows a low-privileged authenticated attacker to exceed their authorized access over HTTP, resulting in full confidentiality and integrity compromise of all application data. The flaw enables unauthorized read access to sensitive corporate financial records as well as creation, deletion, or modification of critical data across the entire HFM instance. No public exploit has been identified at time of analysis, and Oracle addressed this vulnerability in the Critical Patch Update for August 2026.
Full system takeover is possible in Oracle Hyperion Financial Management 11.2.25.0.000 through the Security component, exploitable via SQL by a low-privileged network attacker with no user interaction required. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and full-takeover impact elevate real-world risk for any organization running the affected version.
SQL-layer exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged network attacker to fully compromise data confidentiality and integrity across all accessible financial data. The flaw resides in the Security component, and successful exploitation permits unauthorized read, creation, deletion, and modification of critical data - a particularly severe outcome for an EPM platform handling sensitive financial consolidation records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a high-priority patch target for any Oracle EPM deployment.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthenticated attacker reach the application over TLS and read or alter all data the product can access, with a scope-changing blast radius into adjacent Oracle products. Rated CVSS 10.0, it is trivially exploitable (AV:N/AC:L/PR:N/UI:N) and delivers full confidentiality and integrity compromise while leaving availability untouched. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the perfect score and unauthenticated network reach make it a top-priority patch.
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a low-privileged attacker with network access, operating over the SQL layer, fully compromise the application and - because of a scope change - significantly impact other connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact. No public exploit code has been identified and it is not on CISA KEV, but the low complexity and low privilege bar make it a top-priority patch item.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local-access vulnerability in its Security component that allows an unauthenticated local attacker to achieve full system takeover - compromising confidentiality, integrity, and availability - when combined with required interaction from a separate legitimate user. The attack is constrained to actors with logon access to the infrastructure hosting HFM and requires high complexity to execute, limiting the realistic threat population to insiders or those who have already established a foothold on the target server. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated remote exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 exposes the Security component to authentication bypass via HTTP, enabling attackers to read critical or all accessible financial data and inflict a partial denial of service. The vulnerability is rated CVSS 8.2 (High) with a low-complexity, network-accessible attack vector requiring no privileges or user interaction. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the authentication bypass tag and unauthenticated attack surface make this a meaningful priority for any organization running the affected version.
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allow a remote, unauthenticated attacker to reach the application over HTTP and create, modify, or delete critical data as well as trigger a complete, repeatable crash. Oracle rates this CVSS 9.1 (I:H/A:H, no confidentiality impact), reflecting an easily exploitable network-facing flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch item.
Local privilege escalation with scope change in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged authenticated user on the host system to bypass security controls within the Security component, achieving complete unauthorized read and write access to all application data. The CVSS scope change (S:C) means successful exploitation can cascade into additional Oracle products sharing the same infrastructure, amplifying the blast radius beyond the immediate application. No public exploit code or CISA KEV listing exists at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.25.0.000 enables low-privileged authenticated host users to fully compromise the application's confidentiality and data integrity via a flaw in the Security component. Critically, the CVSS scope change indicator (S:C) signals that successful exploitation may cascade beyond the HFM application boundary to impact additional co-hosted Oracle products. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of required user interaction make exploitation straightforward for any attacker holding a valid local system account.
Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged attacker with HTTP network access, exploiting a flaw in the Security component. Oracle's own description characterizes the outcome as complete compromise, with CVSS 3.1 confirming full confidentiality, integrity, and availability impact (C:H/I:H/A:H), making this more severe than the accompanying 'Information Disclosure' tag suggests. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable via HTTP due to a failure in the Security component's authentication enforcement. Tagged as an authentication bypass, the flaw allows any network-reachable attacker with no credentials or user interaction to access all data within the application's scope, carrying a CVSS 3.1 score of 7.5 (High) reflecting complete confidentiality compromise. No public exploit code or confirmed active exploitation has been identified at the time of analysis, though the low attack complexity lowers the practical barrier for capable adversaries who can reach the service.
Complete data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a network-accessible, low-privileged authenticated attacker to bypass security controls within the application's Security component and gain unauthorized read access to all data the application can reach. The scope change (S:C) in the CVSS vector signals that successful exploitation may expose data beyond the HFM instance itself, potentially impacting other integrated Oracle Hyperion suite components. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity and the Authentication Bypass tag make this a practical risk for any organization running this CPM platform.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 exposes critical financial data to unauthenticated network attackers via HTTPS. The Security component flaw - tagged explicitly as an authentication bypass by Oracle - allows complete read and write access to all data within the application, including sensitive financial consolidation records. No public exploit or CISA KEV listing is confirmed at time of analysis, and the high attack complexity (AC:H) limits opportunistic mass exploitation, but the unauthenticated network vector and dual high-severity impact on both confidentiality and integrity make this a serious priority for organizations running this version.
Unauthenticated remote information disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes the complete data set accessible to the application via HTTP. The Security component contains an authentication bypass weakness that allows a network-adjacent attacker with no credentials to retrieve critical financial data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to target.
Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-authenticated attacker via the SQL interface targeting the Security component, with successful exploitation yielding complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 8.8 reflects low attack complexity and no user interaction required, making exploitation straightforward for any attacker holding valid low-level credentials. No public exploit code has been identified and no CISA KEV listing is present at time of analysis, though the low barrier to exploitation warrants urgent patching for organizations running this version.
Oracle Hyperion Financial Management 11.2.25.0.000 is vulnerable to full system takeover via a SQL-based attack against its Security component, exploitable by any low-privileged network-authenticated user. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability with no user interaction required beyond holding basic credentials. Oracle disclosed this as part of its August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL-based network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged authenticated attacker to fully compromise the application, achieving complete confidentiality, integrity, and availability impact. The vulnerability resides in the Security component and is exploitable with low attack complexity and no user interaction required, making it a reliable attack path for any threat actor holding valid credentials. No public exploit code or active exploitation has been identified at time of analysis.
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated attacker with HTTP network access to fully compromise the application. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and per the CVSS vector requires no privileges or user interaction, making it a prime candidate for opportunistic exploitation. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; despite the Oracle-supplied 'Information Disclosure' tag, the CVSS I:H/A:H metrics and 'takeover' language indicate impact well beyond disclosure.
Unauthenticated remote exploitation of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows network attackers to obtain complete access to all financial reporting data and cause a partial denial of service via HTTPS. The vulnerability resides in the Server component and is tagged as an authentication bypass, meaning no credentials are required to trigger the flaw against a network-exposed instance. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch target for any organization running this specific version.
Unauthenticated remote access to sensitive financial data is possible in Oracle Hyperion Financial Reporting version 11.2.25.0.000 via an authentication bypass in its Server component, exploitable over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no interaction, and no special configuration is required - making this trivially exploitable from any network-reachable position. Impact is limited to confidentiality, but the data exposed (financial reporting data) carries significant business and regulatory risk. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local privilege-assisted attack in its Security component, allowing a low-privileged authenticated user who can log on to the host infrastructure to partially compromise confidentiality, integrity, and availability. The attack demands high complexity and requires interaction from a secondary human actor, placing it firmly in the category of difficult, opportunistic local exploitation. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Oracle via the August 2026 Critical Security Patch Update.
Unauthenticated read-access exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows remote attackers to retrieve a subset of application data via HTTP without any credentials. The flaw resides in the Security component and is tagged as an Authentication Bypass, meaning the component fails to enforce proper access controls on at least one HTTP-accessible endpoint. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the trivial attack conditions (AC:L/PR:N/UI:N) lower the bar for opportunistic reconnaissance.
Partial integrity and availability compromise in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over HTTP, provided high attack complexity conditions are met and a victim user interacts during the attack. Successful exploitation allows unauthorized modification or deletion of a subset of accessible data and can cause a partial denial of service. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local availability vulnerability in its Security component, allowing a high-privileged attacker already logged on to the host infrastructure to cause a partial denial of service. The attack is difficult to execute, requires existing elevated local access, and results only in limited availability degradation with no confidentiality or integrity impact. No public exploit or active exploitation has been identified; CVSS 3.1 Base Score is 1.9, placing this among the lowest-severity tracked vulnerabilities.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a network-accessible vulnerability in its Security component that allows a low-privileged, authenticated attacker to partially compromise data confidentiality and integrity across product boundaries via HTTP. Exploitation requires both high attack complexity and victim interaction, limiting opportunistic exploitation but not eliminating targeted risk in enterprise financial environments. No public exploit code has been identified at time of analysis, and the vulnerability is tagged as an Authentication Bypass by the reporting source, suggesting the Security component may fail to enforce authorization boundaries under specific conditions.
Local privilege abuse in Oracle Hyperion Financial Management 11.2.25.0.000 allows a high-privileged attacker with logon access to the host infrastructure to read a subset of accessible data and perform unauthorized insert, update, or delete operations against that data. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 3.0, reflecting its constrained local attack vector, high complexity, and high privilege prerequisites. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthorized data access and modification in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, contingent on human interaction from a victim. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, enabling partial confidentiality and integrity compromise without attacker credentials. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, but the low attack complexity and zero privilege requirement make social-engineering-assisted attacks practical against exposed instances.
Unauthenticated network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 enables remote attackers to perform unauthorized data manipulation and cause partial denial of service via HTTP against the Security component. The vulnerability requires no credentials and no user interaction, making it trivially accessible to any attacker with network reach to the application. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis; however, the unauthenticated, network-accessible attack surface warrants prompt patching.
Denial-of-service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-adjacent attacker to cause the application to hang or crash repeatedly via crafted HTTP requests targeting the Security component. The flaw is rated Medium (CVSS 5.3) due to high attack complexity, meaning exploitation requires specific conditions to be met beyond simply having network access. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged attacker with local logon access to the host infrastructure, exploiting a flaw in the Security component under conditions of high attack complexity. Despite a moderate CVSS base score of 6.4 - dampened by strict access prerequisites - successful exploitation yields complete confidentiality, integrity, and availability compromise of the application. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes an authentication bypass in its Security component that permits unauthenticated network attackers to perform limited unauthorized read and write operations on accessible financial data via HTTP. The attack is classified as difficult to exploit (AC:H), constraining realistic risk despite the absence of any authentication requirement. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.
Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker targeting the Security component, resulting in complete compromise of confidentiality, integrity, and availability. The attack requires logon access to the infrastructure host where the application runs, limiting exposure to insider threats or attackers who have already established a foothold with elevated privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the local-only attack vector substantially constrains real-world risk despite the full CIA impact.
Confidentiality breach in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible within the application via HTTP, including sensitive financial consolidation records. The vulnerability resides in the Security component and carries an 'Authentication Bypass' classification, suggesting improper enforcement of authorization controls that permits privilege escalation beyond the attacker's intended access level. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high attack complexity requirement indicates exploitation demands specific environmental or application-state conditions.
Local denial-of-service in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with logon access to the hosting infrastructure to hang or repeatedly crash the application via its Security component. The CVSS vector confirms this is a local, high-complexity attack with no confidentiality or integrity impact - purely an availability concern. No public exploit code and no CISA KEV listing exist at time of analysis, and the combination of local access requirement and high attack complexity substantially limits opportunistic exploitation.
Partial unauthorized data access and service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 can be achieved by low-privileged, network-accessible attackers via HTTP targeting the Security component. Exploitation allows unauthorized read of a subset of application data, unauthorized update or insert of accessible data, and partial denial of service - all without user interaction. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
SQL-based exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 enables a high-privileged authenticated attacker to achieve complete read and write access to all financial data within the application. The Security component - the logical gatekeeper for data authorization - is the attack surface, and successful exploitation grants unauthorized creation, deletion, modification, and disclosure of critical financial records. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the 'Authentication Bypass' tag warrants scrutiny given the contradiction with the PR:H CVSS metric (see risk assessment).
Hyperion Financial Management version 11.2.25.0.000 exposes authenticated low-privileged network attackers to a tri-impact vulnerability in its Security component: complete, repeatable denial of service via application hang or crash, limited unauthorized data modification, and partial unauthorized data disclosure. Exploitation requires a valid low-privileged account, HTTP network access, and conditions of high attack complexity - factors that collectively reduce the likelihood of opportunistic or automated attack. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthorized access to all data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged remote attacker exploiting a flaw in the Security component over HTTP. The vulnerability results in complete confidentiality compromise - an attacker can read all data accessible to the application, including sensitive financial consolidation records. No public exploit has been identified at time of analysis, and exploitation is bounded by the requirement for high-privilege credentials, though the 'Authentication Bypass' tag suggests established access may allow security control circumvention beyond the attacker's normal authorization scope.
Unauthorized confidential data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes complete application-accessible data to a network-based attacker already holding high-level privileges, exploiting a flaw within the Security component via HTTP. EUVD metadata tags this as an Authentication Bypass, suggesting an access-control enforcement failure that allows an authenticated high-privileged user to exceed authorized data boundaries rather than a perimeter bypass open to unauthenticated parties. No public exploit code has been identified, and the vulnerability has not appeared in CISA KEV at time of analysis; the high attack complexity further constrains realistic exploitation.
Unauthorized access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by any low-privileged, network-authenticated attacker over HTTP. The flaw resides in the Security component and, per the Oracle tag classification, represents an authorization bypass that permits a low-privilege account to read critical or complete HFM data assets well beyond their assigned permissions. No public exploit has been identified at time of analysis, though Oracle's Critical Security Update for August 2026 formally acknowledges and patches the issue.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged attacker with network access via HTTP to bypass security controls and gain complete read access to all data accessible within the application. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating weaknesses in how the application enforces authorization for authenticated sessions. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the confidentiality impact is rated High, covering critical financial consolidation data.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows any low-privileged authenticated attacker with HTTP network access to bypass security controls within the Security component, gaining read access to all financial data accessible by the application. Tagged as an Authentication Bypass, this suggests low-privileged users can circumvent authorization logic to access data sets beyond their permitted scope. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor's 'easily exploitable' designation and low attack complexity make this a practical risk for organizations running HFM in financial consolidation environments.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 enables low-privileged authenticated users to access critical financial data or all application-accessible data over HTTP. The vulnerability resides in the Security component, and the 'Authentication Bypass' tag in the intelligence data suggests a breakdown in authorization enforcement that allows an authenticated low-privileged user to exceed their intended access scope - effectively escalating read access to sensitive financial records. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and network accessibility make this a practical risk for any organization relying on HFM for financial consolidation.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a low-severity integrity flaw in its Security component that permits a local, unauthenticated attacker - one with OS-level logon to the host infrastructure - to perform unauthorized insert, update, or delete operations against a subset of accessible application data. Exploitation is rated difficult (AC:H) and additionally requires human interaction from a party other than the attacker, substantially constraining real-world opportunity. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, consistent with its 2.5 CVSS base score.
Local authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 exposes a subset of sensitive financial data to unauthenticated local attackers via the Security component. The vulnerability is tagged as an authentication bypass and carries a CVSS 3.1 score of 4.0, reflecting limited confidentiality impact with no integrity or availability consequences. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease-of-exploitation characterization in Oracle's advisory warrants prompt patching in environments where infrastructure access is not tightly controlled.
Hyperion Financial Management version 11.2.25.0.000 contains an authentication bypass in its Security component that allows unauthenticated local attackers to read a subset of application-accessible financial data. The attack vector is strictly local (AV:L), meaning exploitation requires logon access to the host OS infrastructure where Hyperion executes - this is not a remotely triggerable flaw. No public exploit code has been identified at time of analysis, and the CVSS base score of 4.0 reflects limited, confidentiality-only impact with no integrity or availability consequences.
Integrity compromise in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged local attacker - contingent on human interaction from a separate user - to perform unauthorized creation, deletion, or modification of critical financial consolidation data, with potential scope change impact on additional Oracle components. ENISA EUVD-2026-61861 tags this as involving Authentication Bypass within the Security component, though the specific mechanism is not disclosed in Oracle's advisory. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Unauthorized read access to Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP, exploiting a flaw in the product's Security component tagged as an authentication bypass. The CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, zero-privilege exploitation with no user interaction required, limited to partial confidentiality loss. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, placing this in the moderate-priority remediation category despite the sensitivity of financial consolidation data.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity, network-accessible vulnerability in its Security component that allows a high-privileged, authenticated attacker to read a limited subset of application data and cause a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 (Low) accurately reflects the constrained real-world risk: exploitation demands both elevated privileges and high attack complexity, substantially limiting the attacker population. No public exploit code or active exploitation has been identified at time of analysis.
Partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, authenticated attacker over HTTP, targeting the Security component under high-complexity conditions. Impact is limited exclusively to availability - no confidentiality or integrity compromise is possible - resulting in a partial service disruption rather than full outage. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing it at low real-world priority for most environments.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity local vulnerability in its Security component, enabling a high-privileged attacker with local infrastructure logon to perform unauthorized data modification and cause partial denial of service. The CVSS vector (AV:L/AC:H/PR:H) confirms that exploitation requires both physical or logical local access and a high-privilege account, with complex attack conditions that must be met. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, consistent with its low base score and restricted attack surface.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a network-exploitable vulnerability in its Security component that allows a high-privileged authenticated attacker to exfiltrate critical financial data or cause a complete denial of service via crafted HTTP requests. Disclosed as part of Oracle's Critical Patch Update for August 2026 (CSPUAUG2026), this flaw carries a CVSS 3.1 base score of 6.5, driven by High confidentiality and High availability impacts with no integrity effect. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence data introduces a notable ambiguity regarding actual privilege requirements that warrants verification.
Partial confidentiality exposure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows unauthenticated network attackers to read a subset of application data via HTTP under high-complexity conditions. The Security component is tagged as an authentication bypass, though impact is limited to low-severity data disclosure with no integrity or availability consequences. No public exploit code or CISA KEV listing exists at time of analysis.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local privilege escalation via its Security component, enabling a low-privileged infrastructure user to bypass access controls and obtain complete unauthorized access to all financial data the application can reach. The CVSS scope change (S:C) confirms that successful exploitation extends impact beyond HFM itself to additional Oracle ecosystem products sharing the same infrastructure. No public exploit has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables an unauthenticated attacker positioned on the same physical network segment to fully compromise confidentiality and integrity of financial data. The vulnerability is tagged as an authentication bypass in the Security component, meaning an adversary can bypass credential checks and gain unauthorized read and write access to all financial data accessible by the application. No public exploit code has been identified at time of analysis, and the adjacent-network vector combined with high attack complexity limits the realistic attacker population to internal network adversaries or those with network proximity to the deployment.
Local confidentiality breach in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged infrastructure user to bypass Security component controls and gain unauthorized access to critical financial data, with potential spillover into additional connected Oracle products due to a confirmed scope change. The CVSS vector (AV:L/AC:H/PR:L/S:C/C:H) indicates the attack requires local system logon and high complexity, but successful exploitation yields complete read access to all data accessible by the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world immediate risk moderate despite the authentication bypass tag.
Local access exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 enables authenticated low-privileged users with host logon rights to bypass Security component access controls and gain unauthorized read access to all HFM-accessible financial data, plus limited write capability. The vulnerability is tagged as an Authentication Bypass within the Security component itself - not a peripheral feature - meaning the core authorization enforcement mechanism is circumvented. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and realistic insider-threat scenario make this actionable for organizations running HFM on-premises.
Local confidentiality exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged attacker with local system logon to read critical or all accessible financial data within the application. The vulnerability resides in the Security component and is classified as easily exploitable given low attack complexity and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to gain complete read access to all data accessible by the application via HTTP. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, indicating that an attacker with a valid but low-privileged account can circumvent authorization controls to read critical financial data beyond their intended scope. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network attack vector make this straightforward to exploit once credentials are obtained.
Unauthorized data disclosure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows low-privileged, network-based attackers to access critical or complete application data via HTTP. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating that existing authorization controls can be circumvented by an attacker holding any low-privilege account, exposing all financial data accessible within the application. No public exploit code has been identified at time of analysis, and Oracle has addressed the issue in its Critical Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to access all data accessible to the application via HTTP, targeting the Security component. The 'Authentication Bypass' tag suggests an authorization control failure permitting privilege escalation within an authenticated session, enabling full confidentiality compromise of sensitive financial consolidation data. No public exploit or active exploitation has been identified; this was disclosed as part of Oracle's Critical Security Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a network-accessible low-privileged attacker to read all data the application can access via a flaw in its Security component over HTTP. The vulnerability is tagged as an authentication bypass, suggesting that while a low-privilege session is sufficient to initiate the attack, the Security component fails to enforce authorization boundaries that should restrict access to higher-privilege data. No public exploit code has been identified and no active exploitation is confirmed by CISA KEV at the time of analysis.
Unauthenticated remote compromise of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows network-adjacent attackers to read a subset of financial reporting data and perform unauthorized insert, update, or delete operations against Repository data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) combined with the 'Authentication Bypass' tag confirms that no credentials are required and exploitation is straightforward against exposed instances. No patch bypass, public exploit code, or CISA KEV listing has been identified at time of analysis, though Oracle classifies this as 'easily exploitable.'
Vulnerability in the Hyperion Financial Management product of Oracle Hyperion (component: Task Automation). Rated low severity (CVSS 3.9), this vulnerability is remotely exploitable.
Vulnerability in the Hyperion Financial Management product of Oracle Hyperion (component: Security). Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable. No vendor patch available.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: OAM). Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104 allows remote attackers to execute arbitrary code via unknown vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.