EUVD-2026-79793
GHSA-fj5c-qq54-q76w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SOAP endpoint reachable without credentials per the advisory, so PR:N/UI:N/AC:L; availability-only impact, no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
AnalysisAI
Unauthenticated denial of service in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 lets any attacker who can reach the product's SOAP interface send crafted requests that hang or repeatedly crash the service, wiping out availability of the master-data hub. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) in the Access and Security component, with no confidentiality or integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The prerequisite is network reachability to Oracle Hyperion Data Relationship Management 11.2.26.0.000's SOAP interface - specifically the host/port serving the DRM Access and security web services (typically the WebLogic-managed HTTP/SOAP listener rather than the admin console). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector describes an ideal denial-of-service profile: network reachable (AV:N), low complexity (AC:L), no privileges (PR:N) and no user interaction (UI:N), with high availability impact and zero impact on confidentiality or integrity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update referenced in https://www.oracle.com/security-alerts/cspusep2026.html - for this CVE the target release is Hyperion Data Relationship Management 11.2.26.0.000. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today