CVE-2026-71148: Medium severity Oracle Oracle Hyperion Financial Management vulnerability
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Hyperion Financial Management (Security)to a version that resolves this vulnerability.Fixed in 11.2.25.0.000
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Oracle Hyperion Financial Management deployments running the supported affected version 11.2.25.0.000 are exposed if an attacker can reach the product over HTTP. No authentication or user interaction is required.
What can an attacker achieve?
An unauthenticated network-based attacker can obtain unauthorized read access to a subset of data accessible through Oracle Hyperion Financial Management. The available information indicates confidentiality impact only, with no stated integrity or availability impact.
Does exploitation require a particular configuration or valid account?
The provided information identifies HTTP network access as the attack path and states that exploitation is easy. It does not require privileges, authentication, or user interaction; no further configuration prerequisites are specified.