EUVD-2026-79872
GHSA-9cx6-j992-3w46
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HFM web tier over HTTP
-
DeliverySend crafted request bypassing authentication
-
ExploitGain unauthenticated data-plane access
-
ExecutionRead all financial data
-
ImpactCreate/delete/modify critical records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Hyperion Financial Management 11.2.26.0.000 (component: Security). Oracle rates it 'easily exploitable' with AV:N/AC:L/PR:N/UI:N, meaning no valid credentials, no user interaction, and no non-default configuration are required. The primary limiting factors are network reachability of the HFM web interface (typically an internal enterprise application rather than internet-exposed) and the version constraint to 11.2.26.0.000; impact is confined to confidentiality and integrity of HFM data with no availability/DoS effect (A:N). |
| Impact | This is a genuine high-priority pre-authentication flaw in a data-critical financial application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated network exploitation with no user interaction, and CWE-287 (Improper Authentication) plus the 'Authentication Bypass' tag corroborate that this is a true auth bypass rather than a mislabeled authenticated bug. The 9.1 score (vs. a full-triad 9.8) is honestly capped by A:N - the vulnerability yields full read (C:H) and full create/delete/modify (I:H) of all HFM-accessible data but no availability impact. Signals partially conflict on urgency: SSVC records Exploitation=none (no observed exploitation) even though Automatable=yes and Technical Impact=total, and there is no CISA KEV listing, no public POC, and no EPSS score supplied - so despite the alarming base score, there is currently no evidence of real-world exploitation. Net: a real priority to patch given pre-auth network access to critical financial data and 'automatable=yes', but not evidence of active campaigns; treat as high-urgency remediation rather than emergency incident response. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to the HFM web tier sends a crafted HTTP request that bypasses authentication (CWE-287) and gains read plus create/delete/modify access to all Hyperion Financial Management data. This could be used to exfiltrate consolidated financial statements or tamper with reported figures. No public exploit code has been identified at time of analysis, but SSVC rates the attack as automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated, remote attackers with HTTP reachability to Hyperion Financial Management 11.2.26.0.000 can bypass authentication in the product's Security component and then create, delete or modify critical financial data and read all HFM-accessible data, matching Oracle's own 'easily exploitable' rating and a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, no availability impact). The CWE-287 classification frames this as a pre-authentication control failure rather than a memory-safety bug, so a crafted request that reaches the vulnerable endpoint is treated as legitimate; CISA's SSVC framework records Exploitation: none, Automatable: yes and Technical Impact: total. There is no CISA KEV entry and no public exploit code identified at time of analysis (ENISA EUVD-2026-79872 tracks the same single affected version), but this is a genuine high-priority pre-authentication flaw in a data-critical financial application whose main practical constraint is network exposure of the HFM web tier.
RemediationAI
Patch available per vendor advisory: apply the Oracle Critical Patch Update referenced at https://www.oracle.com/security-alerts/cspusep2026.html, which is the authoritative fix channel for CVE-2026-87217; the supplied data does not name a specific fixed build number, so confirm the corrected version through Oracle support/My Oracle Support rather than inferring an increment from 11.2.26.0.000. If the update cannot be applied immediately, the most effective compensating control is exposure reduction, since exploitation requires network reachability of the HFM web interface over HTTP: place the application behind a VPN or an authenticating reverse proxy, restrict inbound access to trusted corporate ranges at the firewall, and segment the HFM tier so that a bypass exposes less data - the trade-off is degraded remote or partner access and possible breakage of integrations and scheduled jobs that legitimately call that interface. A WAF or generic authentication-bypass signature is a weak substitute, because the defect is in application-level authentication logic and benign-looking requests will pass inspection, and per-request authorization rules tend to generate false positives against normal HFM traffic. Because impact is to integrity and confidentiality with no availability effect, pair any interim control with tighter monitoring: enable and review HFM and database audit logs for unexpected session creation, privilege changes or bulk data modifications, and treat unexplained changes to financial consolidation data as a possible indicator of compromise. Disabling the Security component's endpoints outright is not a viable standalone workaround, as authentication is required for normal operation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Hyperion Financial Management (HFM) is Oracle's financial consolidation, close and reporting application, typically deployed as an internal enterprise web application in front of an Oracle database; both Oracle's description and ENISA EUVD-2026-79872 pin the affected build to 11.2.26.0.000 with the vulnerable component listed as 'Security'. The defect is classified CWE-287 (Improper Authentication), meaning the application fails to correctly verify caller identity or apply its authentication check before exposing protected functionality; the assessed vector (PR:N/UI:N) confirms no valid credentials and no victim interaction are needed, only network access over HTTP. Because the vector shows C:H/I:H with A:N, exploitation is a silent read/write compromise of HFM data rather than a denial-of-service - nothing crashes, so the primary detection surfaces are application and database audit logs and anomalous data changes rather than host or process availability telemetry. No CPE strings were supplied in the source data, so asset scoping must rely on the vendor's explicit version statement instead of automated matching.
Know when Hyperion Financial Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vendor states easily exploitable unauthenticated HTTP access (AV:N/AC:L/PR:N/UI:N); full read and modify of all data gives C:H/I:H, no availability impact so A:N, no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Hyperion Financial Management 11.2.26.0.000 contains a critical authentication bypass that lets any unauthenticated attacker with HTTP reachability to the application assume a trusted identity and read, alter, or delete the financial data HFM manages. Because this platform underpins financial consolidation and external reporting, unauthorized modification of its records directly threatens the integrity of the numbers leadership relies on for disclosure, forecasting, and audit. No public exploit code has been identified and there is no vendor-released patch, but the flaw is fully automatable and any internet- or broadly reachable deployment should be treated as an active exposure until containment is in place.
No vendor-released patch identified at time of analysis. Interim mitigations: remove internet exposure and restrict HTTP reachability to Hyperion Financial Management 11.2.26.0.000 to trusted internal subnets via firewall, load-balancer, or reverse-proxy allowlists; block unauthenticated requests to Security component authentication endpoints at the WAF/gateway layer; place the application behind an authenticated access gateway requiring MFA; enable and monitor authentication and administrative audit logging with alerting on anomalous data changes; rotate stored credentials and service accounts; engage Oracle support for an emergency patch timeline and track the vendor advisory for CVE-2026-87217.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthen
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a val
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated att
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentic
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privi
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Securit
Exploit-DB