EUVD-2026-79785
GHSA-5c87-rgqv-pjmm
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network attack via SMTP with no user interaction, but high complexity from the required message preconditions and no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an authentication bypass in the Access and Security component that can be reached over the network through SMTP, allowing an unauthenticated attacker to create, delete, or modify critical data and to read the entirety of the application's accessible data. Oracle's security alert rates it 7.4 with high confidentiality and integrity impact but high attack complexity, indicating the exploit path is non-trivial even though no credentials or user interaction are required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Risk Assessment | The signals here are mixed and should be read carefully rather than as a simple high-severity alert. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix identified in Oracle's Critical Security Patch Update at https://www.oracle.com/security-alerts/cspusep2026.html - that advisory is the authoritative source for the exact patched build in the 11.2.26.0.x line, and you should verify the corrected version number against it rather than assuming a generic 'latest' upgrade satisfies the requirement. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today