EUVD-2026-79797
GHSA-v6r8-gpjj-pxrm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Reachable over HTTPS with no attacker credentials, but a separate victim must interact, so UI:R; integrity is the real impact, no confidentiality loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Hyperion Data Relationship Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L).
AnalysisAI
Unauthorized creation, deletion, and modification of critical master data plus partial denial of service in Oracle Hyperion Data Relationship Management 11.2.26.0.000 can be triggered by an unauthenticated attacker with network access over HTTPS, provided a victim other than the attacker is persuaded to interact with attacker-supplied content. The flaw sits in the Access and Security component, scores 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L), and carries no confidentiality impact - the damage is data integrity and reduced availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must reach the Oracle Hyperion Data Relationship Management HTTPS interface over the network and needs no credentials of their own (PR:N/Victim-interaction), but exploitation only succeeds when a person other than the attacker - typically an authenticated DRM user with rights over hierarchy, access, or security data - is induced to interact with attacker-supplied content; UI:R is the defining gate here. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are moderately strong but not alarming: CVSS 7.1 with AV:N/AC:L makes the attack trivially reachable and technically simple, while PR:N confirms no authentication is required of the attacker - but UI:R means a human other than the attacker must be induced to interact, which blocks fully automated mass exploitation and is the single biggest reason this is not a worm-class event. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update referenced in advisory https://www.oracle.com/security-alerts/cspusep2026.html - Oracle's guidance is that the fix is delivered through the standard Hyperion DRM patch-set upgrade path for the 11.2.x line, and the exact patched build number is not stated in the supplied data, so confirm it against the advisory before closing out. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today