EUVD-2026-79827
GHSA-7qwh-gj68-3qhj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege HFM account
-
DeliverySend crafted HTTP request to Security component
-
ExploitExploit flaw crossing trust boundary (S:C)
-
ExecutionEscalate to full application takeover
-
ImpactCompromise integrated downstream products
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a network-reachable HTTP interface to the Oracle Hyperion Financial Management Security component (version 11.2.26.0.000) and a valid low-privilege application account (PR:L) - this authentication requirement is the primary limiting factor, as the flaw is not remotely unauthenticated. No user interaction is needed (UI:N) and Oracle rates it easily exploitable (AC:L). The scope change (S:C) means a successful attack can significantly impact additional integrated products beyond HFM itself, widening blast radius. No specific non-default feature or configuration toggle is named in the advisory; the vulnerability lies in the core Security component. |
| Impact | This is a genuine high priority, not an inflated CVSS. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) describes an easily exploitable, network-reachable flaw in the Security component of Oracle Hyperion Financial Management that yields full confidentiality, integrity and availability compromise ('takeover') with only low privileges and no user interaction, plus a scope change (S:C) meaning impact extends beyond the vulnerable component into additional products. The 9.9 (just below a pre-auth 10.0) is well-calibrated: the sole real limiter is PR:L - the attacker needs some existing low-privilege account, which is a meaningful gate in a financial-consolidation system but far weaker than an admin requirement. Countervailing signals lower the urgency versus a headline 9.9: no EPSS score is provided, the CVE is NOT in CISA KEV, and no public exploit code is identified - so there is no evidence of active or automatable exploitation. Oracle's Critical Patch Update (cspusep2026) provides zero technical detail and no CWE is assigned, so root cause is unknown. Net: patch promptly given the severity, scope change and low bar, but treat exploitation likelihood as speculative rather than imminent absent EPSS/KEV/POC data. |
| Exploit ScenarioDerived | An attacker holding any low-privileged Hyperion Financial Management application account sends crafted HTTP requests to the Security component, escalating to full control of the HFM instance and, via the scope change, adjacent integrated products. No public proof-of-concept exists and the flaw is not known to be actively exploited, but the vendor rates it easily exploitable requiring no user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a valid low-privilege application account and can reach the product's HTTP interface, because the Security component does not adequately enforce privilege boundaries (assessed CVSS 3.1 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). No user interaction is required, and the scope change (S:C) means a successful compromise can significantly impact additional integrated products that trust HFM, widening the blast radius well beyond the vulnerable host itself. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the risk is driven by the trivial exploitation path available to anyone who can obtain a low-privilege login rather than by observed active exploitation.
RemediationAI
Patch availability is indicated by Oracle's security advisory at https://www.oracle.com/security-alerts/cspusep2026.html (Critical Security Patch Update), so the primary action is to apply the vendor fix for Hyperion Financial Management 11.2.26.0.000 from that alert; the exact patched build number is not specified in the provided data and must be confirmed against the advisory, and because this is an Oracle CPU-style release, reviewing the accompanying patch-set notes for required WebLogic or database-side updates is advisable. Until patching is complete, the most effective compensating control is to sharply restrict which accounts and networks can reach the HFM HTTP services: place the application behind an authenticated reverse proxy or VPN, restrict the HTTP listener to trusted management and finance subnets with deny-by-default firewall rules, and audit for unnecessary low-privilege application logins, since PR:L is the primary mitigating factor for this flaw - the trade-off is reduced flexibility for legitimate remote finance users, who will need VPN or proxy enrollment. Given the scope change, additionally limit HFM's outbound trust to downstream integrated products where feasible and monitor those integrations for anomalous activity originating from HFM identities, accepting that tighter trust boundaries may break cross-product single sign-on or replication workflows until they are re-approved. Finally, since no user interaction is required and segmentation alone does not reduce impact for users who must reach the application, prioritize the vendor patch over long-term reliance on these network controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Hyperion Financial Management is a web-delivered financial consolidation and reporting application, and the flaw resides in its Security component, which mediates authentication, authorization, and trust relationships for the product's HTTP-facing services. Oracle's advisory does not publish a CWE identifier for this issue, so the precise root-cause class cannot be confirmed from the available data; what is established is that the weakness is reachable over the network via HTTP and that an actor with only low privileges (PR:L) can escalate to full control of the application. The scope-change metric (S:C) is the notable technical characteristic: exploitation can affect resources beyond the vulnerable component's own security authority, meaning downstream or integrated products that consume HFM identity, session, or data trust may be impacted as well. Oracle rates the issue as easily exploitable with no user interaction (AC:L/UI:N), which points to a deterministic, repeatable attack path rather than one requiring timing, race conditions, or victim coercion. Public tags classify the entry under Oracle and 'Information Disclosure', but the assessed CVSS vector assigns high confidentiality, integrity, and availability impact, so any information-disclosure framing should be treated as taxonomy shorthand rather than a cap on impact.
Know when Hyperion Financial Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network HTTP with low complexity, requires a low-privilege account (PR:L), no user interaction; scope change and full takeover justify S:C with C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Hyperion Financial Management 11.2.26.0.000 - the platform many organizations rely on for statutory and management consolidation and external financial reporting - can be fully taken over by anyone holding an ordinary low-privilege application login, with no patch currently available from the vendor. Because the flaw breaks privilege boundaries within the product's Security component and carries a scope change, a single compromised account can extend trust downstream into integrated systems that rely on HFM for authentication and data, meaning the exposure is not confined to the HFM servers themselves. Leadership should care because the affected data underpins financial statements and controls over financial reporting, so unauthorized alteration or disclosure carries regulatory, audit, and reputational consequences well beyond IT operations.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the HFM HTTP interface to trusted hosts only; enforce least privilege and aggressively prune low-privilege application accounts; rotate credentials and enable multi-factor authentication at the access layer; segment HFM from integrated downstream products to limit scope-change blast radius; enable and monitor Security component audit logging with SIEM alerting for privilege escalation and anomalous sessions; review and tighten trust relationships and SSO dependencies; engage Oracle Support for mitigation guidance and patch timeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthen
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated att
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentic
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privi
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Securit
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management Security component over TCP can bypass
Exploit-DB