EUVD-2026-61773
GHSA-wrrq-cr6v-hfgh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-accessible HFM HTTP endpoint
-
ExploitSend unauthenticated HTTP request to Security component
-
ExecutionBypass authentication gate
-
ImpactRetrieve confidential financial data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions required for exploitation beyond network access to the HFM HTTP service on port 80 or 443. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations of Oracle Hyperion Financial Management 11.2.25.0.000. The primary limiting factor is network reach: if HFM is deployed solely on internal networks with no internet exposure and strict firewall controls, external attackers cannot reach it. Internal network access (e.g., a compromised internal host or malicious insider) would still satisfy the attack vector. The impact is scoped to data accessible within HFM (S:U), so privilege escalation to the underlying OS is not implied by this CVE. |
| Impact | The CVSS 3.1 score of 7.5 (High) is well-supported by the vector: network-accessible, low complexity, no privileges, no user interaction, with complete confidentiality impact. These signals align - there is no apparent conflict between the vector and the description. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC is known at time of analysis. However, the combination of PR:N and AC:L means any organization running HFM 11.2.25.0.000 on a network-accessible host faces meaningful risk; even a mid-sized municipal IT team in zabrze - were they running Oracle HFM for budget consolidation - should treat this as urgent given the zero-credential attack path. The impact is confidentiality-only (I:N, A:N), meaning integrity and availability are not directly threatened by this CVE, which modestly reduces operational urgency compared to a full RCE. |
| Exploit ScenarioDerived | An unauthenticated attacker with HTTP access to the Oracle HFM host sends a crafted request to the Security component endpoint, bypassing authentication controls. The server responds with financial consolidation data - potentially including sensitive corporate financial figures, subsidiary data, or internal reporting structures - without requiring any credentials. No exploit code is publicly known at this time, but the low complexity of the CVSS vector suggests this is reproducible with minimal tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Unauthenticated remote information disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes the complete data set accessible to the application via HTTP. The Security component contains an authentication bypass weakness that allows a network-adjacent attacker with no credentials to retrieve critical financial data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to target.
RemediationAI
Apply Oracle's Critical Security Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. The advisory addresses this flaw in version 11.2.25.0.000; the exact patched version number is not independently confirmed from available data - consult the Oracle advisory directly for the target patch level. As a compensating control prior to patching, restrict network access to HFM HTTP interfaces using a firewall or network ACL to limit exposure to trusted internal subnets or VPN-only segments, accepting the trade-off of reduced remote access for financial reporting users. Disabling or removing external/internet-facing access to the HFM Security component endpoint would materially reduce attack surface if the advisory endpoint can be identified from Oracle documentation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Hyperion Financial Management (HFM) is an enterprise financial consolidation and reporting platform. The vulnerable component is the Security layer of version 11.2.25.0.000, which handles authentication and authorization over HTTP. The CWE is not formally assigned in available data, but the reporter tag 'Authentication Bypass' points to an access-control failure - likely CWE-287 (Improper Authentication) or CWE-306 (Missing Authentication for Critical Function). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms full network reachability with no complexity or privilege requirements, consistent with a missing or bypassable authentication gate on an HTTP endpoint.
Know when Hyperion Financial Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable HTTP endpoint with no auth required; confidentiality fully compromised, no integrity or availability impact described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle Hyperion Financial Management version 11.2.25.0.000 allows unauthorized network-based access to complete financial datasets without authentication; no public exploit identified at time of analysis, yet the low attack complexity creates immediate operational risk. Organizations running this version face threats to regulatory compliance, audit readiness, and competitive position through unauthorized financial data access. Immediate containment and rapid remediation planning are critical, as no vendor patch is available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network segmentation restricting Hyperion instances to authorized internal networks only; (2) Deploy IP whitelisting and require VPN or bastion host authentication for all connections; (3) Configure Web Application Firewall rules to detect and block unusual queries or bulk data exports; (4) Enable comprehensive audit logging of all financial data access and retrieval; (5) Implement real-time alerting on large result sets or automated data queries; (6) Disable remote access protocols where operationally feasible; (7) Tune network intrusion detection systems to identify exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthen
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a val
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated att
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentic
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privi
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Securit
Exploit-DB