EUVD-2026-79831
GHSA-x565-5f2c-gx5p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HFM Security service over TCP
-
DeliverySend auth-bypass request
-
ExploitObtain unauthenticated session
-
ExecutionRead all accessible financial data
-
ImpactCreate/delete/modify critical records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network TCP reachability to the Oracle Hyperion Financial Management Security component on affected version 11.2.26.0.000; per the vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or non-default configuration is stated as required - an unauthenticated attacker who can reach the service can compromise it. Realistic limiting factors: HFM is typically an internal enterprise EPM system, so exposure depends on whether the service is reachable from an attacker-controlled network segment (often internal-only, not internet-facing), which materially constrains real-world reach; impact is confined to confidentiality and integrity of HFM data (A:N - no availability/DoS effect). |
| Impact | This is a genuinely high-priority pre-authentication flaw, not a paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) describes remote, unauthenticated, low-complexity network exploitation over TCP requiring no user interaction, and the CWE-287 (Improper Authentication) classification plus the 'Authentication Bypass' tag corroborate a true auth-bypass rather than a mislabel. The A:N (no availability impact) is what drops it from 9.8 to 9.1 - the attacker gains full read and create/delete/modify over all HFM-accessible data but no direct DoS. Signals partially conflict on urgency: SSVC scores Exploitation=none (no observed exploitation) but Automatable=yes and Technical Impact=total, meaning that IF an exploit emerges it could be scripted broadly against total-impact targets. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation today - the risk is latent/potential rather than in-the-wild. This CVE is a near-twin of CVE-2026-87173 (same product, same Security component, same 9.1 vector) from the same Oracle September 2026 CPU, suggesting a cluster of related Security-component auth defects. Priority: patch promptly given pre-auth + financial-consolidation data exposure, while noting no confirmed exploitation yet. |
| Exploit ScenarioDerived | An unauthenticated attacker with network TCP reachability to the Oracle Hyperion Financial Management Security component sends crafted traffic that bypasses authentication, then reads and tampers with all HFM-accessible financial-consolidation data - creating, deleting, or modifying critical records. No credentials, user interaction, or special timing are needed (AV:N/AC:L/PR:N/UI:N). No public proof-of-concept exploit is identified at time of analysis, so exploitation would currently require original development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management Security component over TCP can bypass authentication and gain unauthorized access to, and modification of, all data managed by the affected deployment. The flaw is rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and affects only version 11.2.26.0.000; there is no availability impact, so the exposure is full compromise of confidentiality and integrity rather than denial of service. At time of analysis there is no public exploit identified, though CISA's SSVC assessment marks the flaw as fully automatable with total technical impact, so a patch should be prioritized ahead of any observed exploitation.
RemediationAI
Apply the fix released in Oracle's Critical Security Patch Update for this CVE (advisory: https://www.oracle.com/security-alerts/cspusep2026.html); Oracle's CSPU advisories for Hyperion map to the matching Hyperion patch set, so deploy the current HFM patch for the 11.2.26.x line and re-verify the build level after installation. Because this is a pre-authentication bypass (CWE-287), credential rotation and authentication hardening alone will not close the hole - the code fix is required. Until patched, the effective compensating control is network isolation: block TCP access to the HFM Security component from all segments except trusted administrative or application hosts using host and perimeter firewalls, and treat the service as an internal-only asset rather than internet- or DMZ-exposed; the trade-off is that legitimate thick-client and integration traffic must be re-homed onto the allowed segments. Additionally, monitor HFM and application-server logs for anomalous session creation or data-access patterns originating from unexpected source IPs, and, if the deployment permits it, place the HFM tier behind a reverse proxy or VPN gateway that authenticates clients before forwarding traffic - accepting the added latency and the risk that the proxy itself becomes a new attack surface. No vendor-released patch version string or workaround was provided in the source data beyond the Oracle advisory reference.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-287 (Improper Authentication): the Security component of Oracle Hyperion Financial Management fails to correctly verify the identity of a requesting client, allowing an unauthenticated network peer to obtain the access normally reserved for trusted users. HFM is the financial consolidation and reporting tier of Oracle's Enterprise Performance Management (EPM) stack, typically deployed internally on a Java/WebLogic application server fronting a relational database that stores sensitive consolidated financial data - which explains the complete confidentiality and integrity impact (C:H/I:H) with no availability effect (A:N). The vector AV:N/AC:L/PR:N/UI:N/S:U indicates the attack is remotely reachable, low complexity, requires no credentials, no user interaction, and stays within the same security scope, so the only practical barrier is network reachability of the HFM listener rather than any cryptographic or configuration weakness. Note the divergence between the CVSS vector, which asserts no prerequisites, and the SSVC exploitation signal ('none'), meaning no exploitation has been observed even though the weakness is trivially reproducible by anyone who can route packets to the service.
Know when Hyperion Financial Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description states unauthenticated network TCP access with easy exploitation (AV:N/AC:L/PR:N/UI:N), full read plus create/delete/modify (C:H/I:H) but no availability impact (A:N), same scope (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Hyperion Financial Management (HFM) version 11.2.26.0.000 contains a critical unauthenticated vulnerability in its Security component that allows attackers with network access to bypass authentication and read or modify all financial data managed by the deployment. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, but CISA's SSVC assessment rates it fully automatable with total technical impact, making it a severe risk to financial reporting integrity, regulatory compliance (e.g., SOX), and potential fraud. Leadership should prioritize immediate network isolation and monitoring because the flaw exposes all managed data to unauthorized access and modification.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict network access to the Oracle Hyperion Financial Management Security component (TCP) to trusted internal networks and authorized hosts only; deploy virtual patching or intrusion prevention signatures that detect and block exploitation attempts; enforce strict monitoring and alerting on authentication events and data modification activity; and consider temporary service isolation or disabling of remote access until a patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthen
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a val
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated att
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentic
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privi
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Securit
Exploit-DB