Skip to main content

Hyperion Financial Management CVE-2026-71148

| EUVDEUVD-2026-62090 MEDIUM
Improper Access Control (CWE-284)
2026-08-18 secalert_us@oracle.com GHSA-qx3f-xj4r-7x6w
Authentication Bypass Oracle Hyperion Financial Management
5.3
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
5.3 MEDIUM

Network-accessible unauthenticated HTTP bypass with no interaction required; impact bounded to partial read of application data with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
Analysis Generated
Aug 19, 2026 - 03:20 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthenticated read-access exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows remote attackers to retrieve a subset of application data via HTTP without any credentials. The flaw resides in the Security component and is tagged as an Authentication Bypass, meaning the component fails to enforce proper access controls on at least one HTTP-accessible endpoint. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network-level HTTP access to an Oracle Hyperion Financial Management 11.2.25.0.000 instance - specifically to the Security component's HTTP endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) places this in the Medium range, reflecting a real but bounded risk - unauthenticated network access with limited read-only impact and no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply Oracle's Critical Security Patch Update for August 2026, referenced at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability in Oracle Hyperion Financial Management 11.2.25.0.000. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Hyperion Financial Management

View all
CVE-2012-1714 CRITICAL
10.0 Dec 21

Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104
CVE-2019-10219 MEDIUM POC
6.1 Nov 08

A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
CVE-2026-70921 CRITICAL
10.0 Aug 18

Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthen
CVE-2026-70920 CRITICAL
9.9 Aug 18

Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a

CVE-2026-70817 CRITICAL
9.8 Aug 18

Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated att
CVE-2026-70854 CRITICAL
9.1 Aug 18

Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Securit
CVE-2026-70944 HIGH
8.8 Aug 18

Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network att
CVE-2026-70940 HIGH
8.8 Aug 18

Full system takeover is achievable in Oracle Hyperion Financial Management 11.2.25.0.000 through a flaw in its Security

CVE-2026-70928 HIGH
8.8 Aug 18

Full system takeover is possible in Oracle Hyperion Financial Management 11.2.25.0.000 through the Security component, e
CVE-2026-70821 HIGH
8.8 Aug 18

Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-au
CVE-2026-70818 HIGH
8.8 Aug 18

SQL-based network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged authenticat
CVE-2026-71150 HIGH
8.8 Aug 18

Full compromise of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by low-privileged network at

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-71148 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy