EUVD-2026-79870
GHSA-9xfx-x86p-57qf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-reachable TCP service with low complexity and no user interaction, but availability-only impact justifies A:H with C:N/I:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
AnalysisAI
Unauthenticated remote denial of service in Oracle Hyperion Financial Management 11.2.26.0.000 (Security component) lets any attacker who can reach the service over TCP cause a hang or repeatable full crash of the application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is fixed through Oracle's Critical Security Patch Update cycle described in the cspusep2026 advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability (TCP) to the Oracle Hyperion Financial Management 11.2.26.0.000 Security component service - no credentials, no user interaction and no non-default configuration are needed per the CVSS vector AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector is maximal on the availability axis: AV:N with AC:L, PR:N and UI:N means an unauthenticated attacker with network reachability can trigger the condition without credentials, user interaction or special preconditions, and A:H reflects a hang or repeatedly reproducible full outage. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update referenced in https://www.oracle.com/security-alerts/cspusep2026.html - Oracle's advisory is the authoritative source for the exact patched build for Hyperion Financial Management 11.2.26.x, and the specific fix version is not stated in the supplied data, so confirm it against the advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today