Hyperion Financial Reporting

Integrity compromise in Oracle Hyperion Financial Reporting 11.2.25.0.000 enables a low-privileged attacker with local infrastructure access to create, delete, or modify critical financial data managed by the application. Oracle's August 2026 Critical Security Patch Update addresses the flaw, which is rated Medium severity (CVSS 4.7) and is constrained by a local attack vector and high attack complexity. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.

Oracle Hyperion Financial Reporting version 11.2.25.0.000 exposes its Server component to unauthorized data manipulation and read access via a network-exploitable flaw tagged as an Authentication Bypass by Oracle's security team. A low-privileged attacker with HTTP network access can, under difficult-to-achieve conditions, read a subset of accessible financial data and perform unauthorized insert, update, or delete operations. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the financial data sensitivity of the affected platform elevates organizational risk beyond the moderate CVSS base score.

Oracle Hyperion Financial Reporting version 11.2.25.0.000's Server component contains an authentication bypass flaw exploitable by unauthenticated remote attackers over HTTP, as tagged directly by Oracle in their August 2026 Critical Patch Update. Successful exploitation - which demands both high attack complexity and human interaction from a legitimate user - yields complete read access to all data accessible within the Financial Reporting server, plus limited write capability (insert, update, delete) over some records. No public exploit code has been identified at time of analysis; exploitation complexity and the mandatory victim interaction requirement meaningfully constrain opportunistic or automated campaigns.

Unauthenticated remote compromise of Oracle Hyperion Financial Reporting version 11.2.25.0.000 allows network-accessible attackers to read and tamper with financial reporting data via HTTP without any credentials. The Server component is the affected entry point, and the attack is characterized by Oracle as 'easily exploitable,' meaning no special tooling or chaining is required. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, though the authentication bypass tag and zero-privilege requirement lower the bar for opportunistic targeting.

Full system takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by any low-privileged authenticated user over HTTP, with no additional complexity required. The Server component is vulnerable to exploitation that results in complete compromise of confidentiality, integrity, and availability - Oracle's own description uses the word 'takeover'. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low bar to exploitation (PR:L, AC:L, AV:N) makes this a high-priority patching target for any organization running this Oracle Hyperion version.

Unauthorized data exposure in Oracle Hyperion Financial Reporting 11.2.25.0.000 enables unauthenticated remote attackers to read a subset of accessible financial data via HTTP under high-complexity conditions. Tagged as an authentication bypass, the vulnerability is reachable without credentials and without user interaction, yet the AC:H rating signals that reliable exploitation is non-trivial. No public exploit code has been identified and no active exploitation is confirmed; however, the financial sensitivity of data processed by Hyperion EPM elevates the practical significance beyond the raw CVSS 3.7 Low score for affected organizations.

Local privilege escalation in Oracle Hyperion Financial Reporting 11.2.25.0.000 allows a low-privileged attacker with logon access to the host infrastructure to perform unauthorized creation, deletion, or modification of critical data and read a subset of application data - consistent with an application-layer authentication bypass within the Server component. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. The combination of local access requirement and high attack complexity substantially limits opportunistic exploitation, though the integrity impact is rated High by Oracle.

Authentication bypass in Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes critical financial data to unauthenticated attackers who can reach the physical network segment hosting the server. The CVSS vector (AV:A/AC:H/PR:N) indicates that while no credentials are required and no user interaction is needed, exploitation is constrained to adjacent-network attackers and involves high attack complexity. Successful compromise yields full read and write access to all financial reporting data - including unauthorized creation, deletion, and modification of critical records. No public exploit or CISA KEV listing has been identified at time of analysis.

Unauthorized data modification is possible in Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component), exploitable by low-privileged authenticated attackers over HTTP under conditions of high attack complexity and required third-party user interaction. The impact is confined exclusively to limited integrity - partial unauthorized write access to financial reporting data - with no confidentiality or availability exposure. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the vendor-assigned CVSS score of 2.6 reflects the multiple prerequisite conditions that substantially limit real-world exploitability.

Authentication bypass in Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows unauthenticated remote attackers to obtain complete read access to all financial data accessible to the application, along with limited write capability (insert, update, delete) over HTTP. The vulnerability is classified as difficult to exploit (AC:H), moderately containing real-world risk despite requiring no credentials. No public exploit code or CISA KEV listing exists at time of analysis, but the authentication bypass classification from Oracle's own reporting makes this a meaningful confidentiality risk for organizations using this platform for sensitive financial reporting.

Unauthenticated network exploitation of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows remote attackers to perform unauthorized read and write operations against application data by inducing a victim user to interact with attacker-controlled content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is characteristic of a client-side injection class - most likely Cross-Site Scripting - where the scope change metric indicates that successful exploitation extends impact beyond the immediate Hyperion application to additional products sharing the same session or trust context. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Unauthorized data disclosure in Oracle Hyperion Financial Reporting 11.2.25.0.000 allows a low-privileged authenticated attacker with HTTP network access to read all financial reporting data accessible to the application server. Tagged as an authentication bypass in intelligence metadata, suggesting the Server component fails to enforce authorization boundaries between privilege levels, enabling vertical privilege escalation over data access. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once any valid account is obtained.

Unauthenticated network exploitation of Oracle Hyperion Financial Reporting version 11.2.25.0.000 allows remote attackers to partially read and manipulate application data via crafted HTTP requests, contingent on human interaction from an authenticated user. The vulnerability resides in the Server component and carries a CVSS 3.1 score of 5.4 (Medium), with confidentiality and integrity impacts but no availability effect. No public exploit identified at time of analysis and it is absent from the CISA KEV catalog, though the Oracle CPU advisory for August 2026 addresses it.

Unauthorized read and write access to Oracle Hyperion Financial Reporting 11.2.25.0.000 data is achievable by unauthenticated remote attackers via HTTP, provided a victim authenticated user interacts with attacker-controlled content. The attack achieves a scope change - impacting components beyond the directly targeted server - yielding limited confidentiality exposure and insert/update/delete capability against accessible Financial Reporting data. No public exploit has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.

Unauthorized data access and modification in Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP when a legitimate user is socially engineered into interacting with attacker-controlled content. Classified under the Authentication Bypass tag, the flaw enables partial confidentiality exposure and unauthorized write operations against financial reporting data without requiring any attacker credentials, exploiting the victim's active session. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle released a fix in the August 2026 Critical Patch Update.

Integrity compromise and partial data disclosure in Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes financial reporting data to a local low-privileged attacker who can, under high-complexity conditions, create, modify, or delete critical data and read a subset of accessible reporting records. The Server component is the affected entry point, and exploitation requires an established logon to the infrastructure host. No public exploit has been identified at time of analysis, and the CVSS 3.1 score of 5.3 (Medium) appropriately reflects the local access constraint and difficult exploitation conditions.

Unauthorized read access to Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, with no user interaction or special configuration required. The vulnerability is tagged as an authentication bypass in the Server component, allowing exposure of a subset of Financial Reporting data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication attack vector makes it straightforward to leverage opportunistically.

Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes an authentication-related flaw in its Server component that allows a low-privileged, network-authenticated attacker to gain unauthorized read access to critical financial data and limited write access through crafted HTTP requests - provided a separate user interaction is triggered. Tagged by Oracle as an Authentication Bypass, the vulnerability yields High confidentiality impact and Low integrity impact against version 11.2.25.0.000. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Unauthenticated remote disclosure of sensitive financial data affects Oracle Hyperion Financial Reporting 11.2.25.0.000 via HTTP, with no credentials required to trigger the flaw. Tagged as an authentication bypass, the vulnerability allows a network-adjacent attacker to read critical data or gain complete access to all data accessible by the Financial Reporting server component. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's own description characterizes it as 'easily exploitable.'

Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes an authentication bypass in its Server component, reachable over HTTP without credentials, that allows full read and write access to sensitive financial data. The attack is tagged as an Authentication Bypass by the reporting source (secalert_us@oracle.com) and yields both C:H and I:H impact, meaning an attacker can exfiltrate all accessible financial data and tamper with or delete critical records. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the high-impact outcome against an enterprise financial platform warrants priority patching.

Full application takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by a low-privileged attacker with local OS logon access to the server host, requiring no user interaction and resulting in complete loss of confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects an easily exploitable local flaw in the Server component, with all three impact dimensions rated High. No public exploit code or active exploitation has been identified at time of analysis, though the severity of the described outcome - full application takeover - warrants prompt remediation.

Full system takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP without user interaction. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates the attack is network-accessible and requires no credentials, but high attack complexity (AC:H) implies specific preconditions - such as race conditions, timing requirements, or environmental factors - that prevent trivial mass exploitation. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though full CIA impact at CVSS 8.1 makes this a high-priority remediation target for organizations running this EPM platform.

Oracle Hyperion Financial Reporting version 11.2.25.0.000 is affected by an authentication bypass vulnerability exposing critical financial data to unauthenticated remote attackers over HTTP. Successful exploitation, which requires human interaction from a victim user, grants unauthorized read access to all accessible financial data as well as the ability to create, modify, or delete critical records. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Authentication Bypass tag and CVSS 8.1 score highlight significant risk to corporate financial data confidentiality and integrity.

Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows an unauthenticated attacker with HTTP network access to fully compromise the Server component, yielding complete confidentiality, integrity, and availability loss. Rated CVSS 9.8 and flagged as 'easily exploitable' by Oracle, though tagged as Information Disclosure in EUVD; no public exploit identified at time of analysis and it is not listed in CISA KEV. This is part of Oracle's August 2026 Critical Patch Update and should be treated as high-priority given the unauthenticated network vector.

Full takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by an unauthenticated remote attacker via HTTP, according to Oracle's August 2026 Critical Security Update. The vulnerability resides in the Server component and, if successfully exploited, results in complete compromise of confidentiality, integrity, and availability of the affected instance. No public exploit code or CISA KEV listing has been identified at time of analysis; the High attack complexity rating reduces the likelihood of opportunistic mass exploitation but does not eliminate targeted risk.

Full takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by any low-privileged network attacker communicating via HTTPS, with complete confidentiality, integrity, and availability impact confirmed by a CVSS 3.1 score of 8.8. The vulnerability resides in the Server component and requires only minimal authenticated access, presenting a low barrier for insider threat or compromised-credential scenarios. Oracle formally disclosed and addressed this issue in its August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote unauthenticated compromise of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an attacker with network access via the Java RMI interface to read, create, modify, or delete all data accessible to the application. Carrying a CVSS 3.1 base score of 9.1 and tagged as an authentication bypass, the flaw yields full confidentiality and integrity compromise without any credentials or user interaction, though it does not affect availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an unauthenticated attacker with only HTTP network reach to fully compromise the application, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact reflects complete product compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch.

Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an unauthenticated attacker with only HTTP network access to fully compromise the application, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability and complete-compromise outcome make it a high patch priority.

Vulnerability in the Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file.0.22 and prior 2.0.x versions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

A carefully crafted PDF file can trigger an infinite loop while loading the file.0.22 and prior 2.0.x versions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Vulnerability in the Hyperion Financial Reporting product of Oracle Hyperion (component: Web Based Report Designer). Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the Hyperion Financial Reporting product of Oracle Hyperion (component: Security Models). Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable.

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Vulnerability in the Hyperion Financial Reporting component of Oracle Hyperion (subcomponent: Security Models). Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the Oracle Hyperion Financial Reporting component of Oracle Hyperion (subcomponent: Workspace). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the Oracle Hyperion Financial Reporting component of Oracle Hyperion (subcomponent: Security Models). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

Unspecified vulnerability in the Hyperion Financial Reporting component in Oracle Hyperion 11.1.2.4 allows remote attackers to affect confidentiality, integrity, and availability via vectors related. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.