CVE-2026-71120 in Hyperion Financial Management
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Security component of Oracle Hyperion Financial Management, specifically affecting version 11.2.25.0.000 and potentially other supported releases in that lineage. This flaw represents a significant risk to the availability of financial management systems, as it allows for a denial-of-service condition through network-based exploitation. The vulnerability is classified under CWE-400, which covers uncontrolled resource consumption, indicating that the application fails to properly manage resources when processing specific inputs, leading to system instability or complete failure.
From an operational perspective, this flaw enables low privileged attackers who have network access via HTTP to trigger a hang or cause frequent, repeatable crashes of the Oracle Hyperion Financial Management service. The difficulty level for exploitation is noted as difficult, which suggests that while the vulnerability exists and can be triggered remotely, it may require specific conditions or precise timing to succeed consistently. However, the low privilege requirement means that even users with minimal access rights within the application environment could potentially exploit this flaw if they have network connectivity to the affected service. This highlights a critical gap in input validation or resource management logic where the system does not adequately sanitize or limit the impact of certain HTTP requests before processing them.
The impact of successful exploitation is strictly limited to availability, as indicated by the CVSS 3.1 base score of 5.3 and the vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. This means that while confidentiality and integrity remain unaffected, the complete denial-of-service capability poses a severe operational risk for organizations relying on continuous access to their financial data and reporting tools. An attacker could disrupt business operations by rendering the application inaccessible to legitimate users, causing delays in financial closing processes or preventing critical decision-making based on real-time data. This aligns with ATT&CK technique T1499, Endpoint Denial of Service, where an adversary aims to degrade or deny service availability rather than stealing or altering data.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. The primary action is to apply the latest security patches provided by Oracle for version 11.2.25.0.000 and subsequent updates, as these typically address known resource management flaws in the Security component. Additionally, organizations should implement network-level controls such as Web Application Firewalls (WAFs) to filter out malformed or excessively large HTTP requests that might trigger the vulnerability before they reach the application server. Rate limiting on HTTP endpoints can also help mitigate the impact by preventing rapid-fire requests that could lead to resource exhaustion. Furthermore, ensuring that low-privileged accounts have strictly necessary network access reduces the attack surface available for exploitation of this specific flaw.