EUVD-2026-61805
GHSA-mv64-2frh-f59x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HFM HTTP endpoint over network
-
DeliverySend crafted unauthenticated request
-
ExploitExploit Security component flaw
-
ExecutionModify or delete critical financial data / crash service
-
ImpactData integrity loss or complete DOS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated HTTP exploitation against Oracle Hyperion Financial Management 11.2.25.0.000, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The primary limiting factor is network reachability: the attacker must be able to reach the HFM/EPM web endpoint, so deployments that expose the interface only to a restricted internal or VPN-gated network materially reduce exposure. Exploitation is confined to the stated supported version 11.2.25.0.000 in the available data; applicability to other 11.2.x levels is unconfirmed. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) describes the highest-risk exploitation profile short of a scope change: remote, low-complexity, no privileges, and no user interaction, which is why the base score reaches 9.1. Weighing all signals: there is no EPSS score provided, no CISA KEV listing, and no public proof-of-concept, so real-world exploitation is not yet evidenced - this is a high-severity flaw whose likelihood signal is currently unquantified rather than a confirmed active threat. That said, an unauthenticated, network-reachable integrity-and-DoS bug in a financial-consolidation system is precisely the kind of exposure any organization running HFM should treat as urgent and patch on Oracle's next maintenance window, especially where the application is reachable from broad internal or external networks. The absence of confidentiality impact should not lower urgency, because the ability to alter or destroy financial data and to crash the service on demand carries direct business and compliance consequences. |
| Exploit ScenarioDerived | An attacker who can reach the HFM web interface over HTTP sends a crafted unauthenticated request to the vulnerable Security component and either tampers with or deletes consolidation data, or repeatedly forces the application to hang or crash to deny access during a financial close. Because no authentication or user interaction is required and complexity is low, exploitation could be scripted; no public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allow a remote, unauthenticated attacker to reach the application over HTTP and create, modify, or delete critical data as well as trigger a complete, repeatable crash. Oracle rates this CVSS 9.1 (I:H/A:H, no confidentiality impact), reflecting an easily exploitable network-facing flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch item.
RemediationAI
Apply the fix from the Oracle Critical Patch Update (August 2026) referenced at https://www.oracle.com/security-alerts/cspuaug2026.html; a patch is available per the vendor advisory, though an exact fixed build number is not stated in the source data, so confirm the applicable HFM 11.2.x patch level directly from that CPU. Until patching completes, reduce exposure by restricting network access to the HFM/EPM Workspace HTTP endpoints to trusted management networks or VPN only, placing the application behind a reverse proxy or WAF that limits reachability, and disabling any internet-facing exposure - the trade-off is that legitimate remote finance users must connect through the restricted path, which may require access-policy changes. Increase monitoring for unexpected data-modification events and service crashes on HFM hosts as a detection compensating control while the patch is scheduled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Hyperion Financial Management (HFM) is an enterprise financial consolidation, close, and reporting application within the Oracle Enterprise Performance Management (EPM) suite, typically deployed as a web-facing Java/HTTP application behind Oracle EPM Workspace and Foundation Services. The flaw sits in the product's Security component and is reachable over HTTP without authentication. No CWE was assigned in the source data, so the precise root-cause class (e.g., broken access control, injection, or deserialization) cannot be confirmed; the impact profile - high integrity and availability damage with zero confidentiality impact - is consistent with a missing-authorization or state-corrupting defect rather than a data-disclosure bug.
Know when Hyperion Financial Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Unauthenticated network HTTP access with low complexity (AV:N/AC:L/PR:N/UI:N); impact is high integrity and availability with no confidentiality exposure, consistent with data tampering plus complete DOS.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Executive ViewAI
Oracle Hyperion Financial Management 11.2.25.0.000 contains a critical remote vulnerability allowing unauthenticated attackers to corrupt financial data and trigger complete system outages via HTTP, directly compromising financial record integrity and operational continuity. Organizations running this version face immediate risk to financial data accuracy, compliance posture, and business operations without urgent mitigation.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) restrict HTTP network access to Hyperion systems using firewall rules and network segmentation, limiting connectivity to trusted administrative networks; (2) deploy Web Application Firewall (WAF) rules to detect and block exploitation attempts; (3) implement enhanced monitoring and alerting for unauthorized data modification and system outages; (4) require multi-factor authentication for administrative access where available; (5) maintain validated offline backups of financial data for rapid recovery in case of compromise or system failure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthen
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a val
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated att
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentic
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privi
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management Security component over TCP can bypass
Exploit-DB