## Summary
Oracle Hyperion Financial Management (Oracle Hyperion, component: Security) contains a vulnerability affecting the supported version 11.2.26.0.000. The issue is described as easily exploitable with network access via HTTP, where a high-privileged attacker can compromise the product, leading to takeover.
## Technical Details
- Affected component: Security (Oracle Hyperion Financial Management)
- Affected version: 11.2.26.0.000
- Attack vector: NETWORK via HTTP
- Privileges required: PR:H (high privileges)
- Impact scope: S:U
- Reported impacts: C:H, I:H, A:H (high confidentiality, integrity, and availability impact)
- CVSS 3.1: 7.2 with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
## Affected
- Oracle Hyperion Financial Management 11.2.26.0.000
## Impact
- Takeover of Oracle Hyperion Financial Management after successful exploitation over HTTP.
- High impact on confidentiality, integrity, and availability (C:H/I:H/A:H).
## Mitigation
1. Patch immediately: apply the vendor’s security fix for Oracle Hyperion Financial Management affecting 11.2.26.0.000 (exact fixed version not provided in the available data).
2. Restrict network access to the HTTP-exposed interfaces of Oracle Hyperion Financial Management to reduce reachable attack surface.
3. Ensure only appropriately privileged users can access administrative functions, since exploitation is described with PR:H requirements.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H