EUVD-2026-79845
GHSA-hvrx-j44g-wrvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged HFM account
-
DeliverySend crafted HTTP requests to Security component
-
ExploitSatisfy difficult exploitation conditions (AC:H)
-
ExecutionEscalate to full application takeover
-
ImpactRead/modify all data and disrupt availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged account (PR:L) on the target Oracle Hyperion Financial Management 11.2.26.0.000 instance and network access to its HTTP interface targeting the Security component. Exploitation is explicitly rated 'difficult' (AC:H), meaning success depends on specific timing, configuration, or state conditions not under the attacker's full control - a significant limiting factor. No user interaction is needed (UI:N) and scope is unchanged (S:U). The main defenders' mitigations: restrict and monitor low-privileged HFM accounts, limit HTTP exposure of the Security component, and apply the September 2026 Oracle CPU. Only version 11.2.26.0.000 is listed as affected. |
| Impact | This is a genuinely full-impact vulnerability (C:H/I:H/A:H, described as 'takeover') but the CVSS 3.1 base of 7.5 is held down from the 9.x range seen in its siblings by two real limiters in the vector: AC:H ('difficult to exploit') and PR:L (requires low-privileged authentication). Compared to the pre-auth AC:L Hyperion Security siblings CVE-2026-87184 (SQL, 9.8) and CVE-2026-87190's own product family entries at 9.1-9.8, this one demands both valid credentials and non-trivial attack conditions, so real-world risk is meaningfully lower despite identical impact. There is no CISA KEV listing, no public exploit code, and no EPSS score provided, so exploitation status is: no public exploit identified at time of analysis. Oracle's September 2026 CPU (cspusep2026) provides zero technical detail and no CWE is assigned, so the exploitation mechanism cannot be independently verified. Net: a real patch-priority item for organizations running the affected HFM version - because a low-privileged insider or credential-holder can achieve full takeover - but not an emergency drive-by threat given AC:H + PR:L and absence of any exploitation signal. |
| Exploit ScenarioDerived | A low-privileged but authenticated user of Oracle Hyperion Financial Management sends specially crafted HTTP requests to the Security component under specific conditions that are hard to reliably reproduce (AC:H), ultimately escalating to full compromise of the HFM instance. No public proof-of-concept exists, and the required credentials plus high attack complexity make this more plausible as a targeted insider or post-credential-theft action than opportunistic mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Full takeover of Oracle Hyperion Financial Management is achievable by a low-privileged, authenticated attacker who can reach the product's Security component over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity and availability (C:H/I:H/A:H). Only version 11.2.26.0.000 is listed as affected, and the CVSS 3.1 base score of 7.5 is capped by two meaningful limiters rather than by reduced impact: AC:H, meaning the vendor itself rates the attack 'difficult' and dependent on timing, configuration or state conditions outside the attacker's full control, and PR:L, meaning a valid low-privileged account is a hard prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied, so the practical near-term risk is driven by the severity of the post-exploitation outcome rather than by observed threat activity.
RemediationAI
Patch available per vendor advisory: apply the September 2026 Oracle Critical Patch Update covering Oracle Hyperion Financial Management 11.2.26.0.000, as published at https://www.oracle.com/security-alerts/cspusep2026.html, and confirm the post-patch build number through Oracle's CPU documentation since the sources do not state an exact fixed release. Until the CPU can be applied, the highest-value compensating control is to reduce the population and reachability of low-privileged HFM accounts, because PR:L is a mandatory prerequisite: audit, disable or tightly scope unused and service accounts that can authenticate to the HFM Security component, and alert on anomalous privilege use from those accounts. Second, restrict network exposure of the HFM HTTP interface - place it behind an authenticated reverse proxy or VPN and block direct inbound access from untrusted networks - accepting the operational cost of reduced direct client connectivity and the need to maintain proxy rules as endpoints change. Third, since AC:H implies exploitation depends on fragile state or timing conditions, enable verbose Security-component logging and correlate it with account activity so attempts to satisfy those preconditions are detectable; the trade-off is added log volume and storage overhead. Note that, per the available data, no public exploit code and no confirmed active exploitation exist, so these controls are precautionary rather than incident-driven.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the Security component of Oracle Hyperion Financial Management (HFM), the consolidation and financial-reporting module of the Oracle Hyperion EPM suite, and is reachable over its HTTP interface. Oracle does not publish a CWE mapping for this issue, so the root-cause class is not formally classified; behaviourally, the pattern of a low-privileged (PR:L) session delivered over the network (AV:N) with no user interaction (UI:N) escalating to full read/write/availability impact across an unchanged scope (S:U) is consistent with a broken access-control or privilege-escalation weakness inside the Security component rather than with memory corruption, though this cannot be confirmed from the available data. The AC:H rating indicates exploitation hinges on non-trivial preconditions such as specific configuration state, timing windows or object relationships that the attacker cannot fully control. No CPE identifiers were provided by the sources, and the only authoritative version constraint is the EUVD-listed range of Oracle Hyperion Financial Management 11.2.26.0.000; the retaining CVSS vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H from the independent assessment is the basis for all prerequisite statements here.
Know when Hyperion Financial Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP vector (AV:N); vendor-stated 'difficult to exploit' warrants AC:H; requires low-privileged auth (PR:L); described takeover yields full C:H/I:H/A:H with no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Hyperion Financial Management version 11.2.26.0.000 is exposed to a full system takeover by an authenticated low-privileged user with HTTP access to its Security component, potentially compromising the confidentiality, integrity, and availability of financial consolidation and reporting data. No public exploit identified at time of analysis, and No vendor-released patch identified at time of analysis, but successful exploitation could undermine financial reporting accuracy and regulatory compliance. Leadership should prioritize restricting access and monitoring for misuse until a fix is released.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting HTTP access to the Security component to trusted networks, enforcing multi-factor authentication, minimizing and monitoring low-privileged accounts, and deploying web application firewall rules to detect or block exploit attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthen
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a val
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated att
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentic
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privi
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Securit
Exploit-DB