EUVD-2026-79800
GHSA-4gv6-7q3x-7vj8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Unauthenticated network HTTP request with no user interaction and low complexity supports AV:N/AC:L/PR:N/UI:N; impacts are limited to partial C/I/A.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Data Relationship Management accessible data as well as unauthorized read access to a subset of Oracle Hyperion Data Relationship Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
AnalysisAI
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 is vulnerable to an unauthenticated, network-reachable flaw in its Access and Security component that lets an attacker read sensitive data, modify or delete records, and partially disrupt service availability via crafted HTTP requests. The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N) indicates trivially exploitable remote access with no credentials or user interaction, though the confidentiality, integrity and availability impacts are each rated Low rather than total compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires unauthenticated network access to the DRM HTTP listener on version 11.2.26.0.000, with the Access and Security component reachable; no user interaction and no prior authentication are needed per the CVSS vector (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3) describes an unauthenticated, low-complexity, no-interaction network attack - the most favorable possible preconditions for an attacker, which is why the score lands in the High band despite only Low-tier impacts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary fix: no exact patched version was supplied in the input, so patch availability is not confirmed from the provided data - consult the Oracle security advisory at https://www.oracle.com/security-alerts/cspusep2026.html (Oracle Critical Security Patch Update) and apply the DRM patch it specifies for the 11.2.x line; Oracle ships these fixes as cumulative patch sets and requires the full patch bundle rather than a single file, so plan an application restart and back up the DRM schemas first. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today