CVE-2026-71145 in Hyperion Financial Management
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Security component of Oracle Hyperion Financial Management, specifically affecting version 11.2.25.0.000 and potentially other supported releases in the suite. This flaw is characterized by a complex exploitation path that requires specific conditions to be met before an attacker can achieve any level of compromise. The vulnerability allows for unauthorized access to sensitive data stored within the financial management system, posing risks to both confidentiality and integrity. While the direct target is Oracle Hyperion Financial Management, the nature of enterprise software ecosystems means that successful exploitation could lead to a scope change, impacting additional connected products or services that rely on this platform for critical business logic and data processing.
From a technical perspective, the vulnerability is classified as difficult to exploit due to its high attack complexity requirements. An attacker must possess low privileges within the system but also require network access via HTTP to initiate the exploitation sequence. Crucially, the flaw necessitates human interaction from a user other than the initial attacker. This social engineering aspect significantly raises the barrier for entry, suggesting that the vulnerability likely involves a mechanism where an authenticated user is tricked into performing an action or accessing a resource that triggers the underlying code defect. The requirement for external human involvement indicates that automated scanning tools may not easily detect this issue without active engagement from a victimized user, thereby limiting its prevalence in broad-scale attacks while maintaining significant risk to targeted organizations.
The operational impact of successful exploitation is substantial despite the moderate base score. An attacker who successfully exploits this vulnerability can gain unauthorized read access to a subset of data accessible by Oracle Hyperion Financial Management. This could include sensitive financial records, budgetary information, or proprietary business metrics that are critical for decision-making processes. Furthermore, the integrity impacts allow for unauthorized updates, inserts, or deletes against some of the accessible data. Such modifications could lead to inaccurate financial reporting, corrupted audit trails, and potential compliance violations with standards such as SOX (Sarbanes-Oxley Act) which mandate accurate and tamper-proof financial records. The ability to alter data undermines trust in the system's outputs and can have cascading effects on downstream analytics and strategic planning.
In terms of industry standard classifications, this vulnerability aligns with CWE-79 for Cross-Site Scripting or similar input validation flaws if it involves web-based interactions requiring user clicks, though without specific code analysis, it broadly fits under weaknesses related to insufficient access control or logic errors that require contextual exploitation. The ATT&CK framework would likely categorize the initial access phase as T1566 Phishing due to the human interaction requirement, while the data exfiltration and modification aspects map to techniques involving unauthorized data access and potential persistence if the altered data affects system behavior. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a network-based attack with high complexity, low privileges required for the attacker, but significant scope change implications resulting in limited confidentiality and integrity impacts without direct availability disruption.
Mitigation strategies should focus on both technical controls and user awareness training. Since human interaction is a prerequisite, organizations must implement strict security awareness programs to educate users about suspicious links or requests that might trigger this vulnerability. Technically, applying the latest patches provided by Oracle for version 11.2.25.0.000 is essential if available. If patching is not immediately feasible, network segmentation can help isolate Hyperion Financial Management from less trusted networks, reducing the attack surface exposed via HTTP. Additionally, implementing robust web application firewalls with advanced behavioral analysis may detect anomalous patterns associated with this exploitation attempt. Regular audits of user permissions and data access logs are also recommended to identify any unauthorized modifications or unusual read activities that could indicate a successful compromise has occurred.