EUVD-2026-79873
GHSA-cvw5-wv54-42hg
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Confirms Oracle's AV:A gating to the local segment, unauthenticated low-complexity trigger, with integrity and availability impact but no confidentiality loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
AnalysisAI
Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 server can exploit a flaw in the product's Security component to modify or destroy critical financial data and to crash the application repeatedly. Oracle rates this at CVSS 3.1 base 8.1 with integrity and availability impact but no confidentiality impact, and the restricted AV:A vector means the attacker must already sit on the physical communication segment attached to the host rather than reaching it over the internet. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have access to the physical communication segment attached to the hardware running Oracle Hyperion Financial Management 11.2.26.0.000 - that is, layer-2 adjacency such as the same VLAN, subnet, broadcast domain, or directly attached link, as expressed by the AV:A metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Oracle's own CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) yields 8.1, which is high but deliberately gated by the adjacent-network attack vector: this is not internet-reachable and not something a remote attacker can trigger from an arbitrary host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix published in Oracle's Critical Security Patch Update referenced at https://www.oracle.com/security-alerts/cspusep2026.html, which is the vendor's authoritative remediation channel for Hyperion Financial Management 11.2.26.0.000; patch available per vendor advisory, and the exact patched build number should be taken from that document because it was not included in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today