EUVD-2026-79878
GHSA-vf9w-4j87-cfg6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HFM HTTP endpoint over network
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitTrigger integrity/availability flaw in Security component
-
ExecutionModify or destroy financial data / crash service
-
ImpactData corruption and complete DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Hyperion Financial Management 11.2.26.0.000 (Security component); the vector is AV:N/AC:L/PR:N/UI:N, meaning no credentials, no user interaction, and low attack complexity. The main limiting factors are that the HFM HTTP interface must be network-reachable by the attacker (typically an internal enterprise/back-office network rather than the public internet) and that only version 11.2.26.0.000 is listed as affected. There is no confidentiality impact (C:N); impact is limited to data integrity and denial of service. |
| Impact | This is a genuinely high-priority network-reachable flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, base 9.1) describes an unauthenticated, low-complexity, remote HTTP attack with no user interaction - the hardest-to-mitigate profile. The 9.1 rather than 9.8 reflects C:N (no confidentiality impact); the damage is to integrity (unauthorized create/delete/modify of all HFM data) and availability (complete, repeatable DoS). Mitigating signals: EPSS is not provided, the CVE is NOT in CISA KEV, and no public PoC is identified - so there is no evidence of active or imminent exploitation, only strong theoretical exploitability. Oracle's advisory (cspusep2026) provides zero technical detail and no CWE is assigned, so the precise defect class is unknown. Net: treat as an urgent patch during the September 2026 CPU cycle because of the pre-auth network vector and data-integrity/DoS impact on a financial-consolidation system, but note that exploitation is currently theoretical (no KEV/PoC/EPSS to confirm real-world weaponization). |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the Hyperion Financial Management HTTP interface sends crafted requests that require no valid credentials and no user interaction, letting them tamper with or destroy critical financial-consolidation data and/or crash the service into a complete, repeatable denial of service. Because the CVSS vector is AV:N/AC:L/PR:N, the attack is remote and low-complexity. No public exploit code has been identified, so any current attack would require independent exploit development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Oracle Hyperion Financial Management 11.2.26.0.000 is exposed through its Security component to unauthenticated, network-reachable attackers over HTTP, who can create, delete, or modify critical financial consolidation data and repeatedly crash or hang the application (CVSS 3.1 base score 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Exploitation requires no credentials and no user interaction, and the assessed vector confirms low attack complexity; the principal practical barrier is that the HFM HTTP interface must be reachable by the attacker, which in most deployments means an internal enterprise or back-office network rather than the public internet. There is no confidentiality impact - the flaw affects data integrity and availability only. At the time of analysis, no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); exploitation status and patch availability should be re-checked against the Oracle Security Alert referenced below.
RemediationAI
The input data does not identify a specific fix version for this flaw, so no vendor-released patch version can be quoted here - treat the Oracle Security Alert at https://www.oracle.com/security-alerts/cspusep2026.html as the authoritative source for the patched HFM build and apply the corresponding Critical Patch Update for Hyperion Financial Management 11.2.26.0.000 as soon as it is available, since the pre-authentication, low-complexity vector makes the exposure window matter. Until a patched build is deployed, the most effective compensating control is network restriction: do not expose the HFM HTTP interface to untrusted networks, place it behind a VPN, jump host, or an authenticating reverse proxy, and firewall it to only the application tiers, EPM clients, and administrative subnets that legitimately need it - the trade-off is that legitimate remote and distributed-component traffic to those ports will break until source ranges are allow-listed. Because the flaw carries no confidentiality impact but full integrity and availability impact, prioritize integrity monitoring and offline, immutable backups of HFM applications and underlying databases so that unauthorized data modification can be detected and a denial-of-service crash can be recovered from, accepting that restore is a coarse and potentially service-impacting recovery path. Additional options include disabling or restricting any unused HFM/Shared Services HTTP endpoints and applying WAF or reverse-proxy rules that reject anomalous unauthenticated write requests, with the caveat that such rules are signature-dependent and can produce false positives on legitimate traffic. Monitor Oracle advisory updates and re-evaluate whether the flaw is added to CISA KEV or gains public exploit code, as either would materially raise the urgency of full isolation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Oracle Hyperion Financial Management, the consolidation, reporting, and financial-close module of the Oracle Hyperion EPM suite, and is specifically attributed to the product's Security component. The CWE root-cause class was not published with this advisory, so the precise defect - for example an authorization or input-validation gap in the HTTP-facing security layer - cannot be confirmed from the available data; what can be confirmed is the observable impact profile: full loss of integrity (I:H) and full loss of availability (A:H) with no confidentiality impact (C:N), a combination consistent with an unauthenticated request path that reaches privileged write operations and resource-exhaustion or crash conditions rather than one that discloses stored data. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U places it as a remote, low-complexity, pre-authentication attack that does not require a victim to interact with a crafted page, and no scope change means the impact is contained within the HFM application and its accessible data rather than the underlying host. Only version 11.2.26.0.000 of Hyperion Financial Management is listed as affected by ENISA EUVD (EUVD-2026-79878); no CPE strings were supplied with the input data, so version-level matching should be driven by the vendor advisory.
Know when Hyperion Financial Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Description confirms unauthenticated network HTTP access with low complexity (AV:N/AC:L/PR:N/UI:N); impact is full integrity and complete DoS with no confidentiality (C:N/I:H/A:H), scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Executive ViewAI
Oracle Hyperion Financial Management, the platform underpinning financial consolidation and statutory reporting, is exposed to unauthenticated network attackers who can alter or destroy consolidated financial data and repeatedly take the application offline. Because the flaw requires no credentials and no vendor fix is currently available, any organization running HFM 11.2.26.0.000 with a reachable HTTP interface faces potential misstatement of reported financials plus extended reporting outages. Leadership should treat this as a material risk to financial reporting integrity, audit outcomes, and disclosure timelines until Oracle releases a remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability to the HFM HTTP interface to trusted administrative subnets and VPN/jump-host access only; enforce firewall and security-group rules to block untrusted internal and external sources; deploy WAF/IPS virtual patching against malformed requests to the HFM Security component; enable detailed logging, file-integrity monitoring, and alerting for unexpected creation, deletion, or modification of consolidation data and for application crashes or hangs; maintain and test offline backups of consolidation data for rapid restoration; and engage Oracle Support for interim guidance pending a vendor fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthen
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a val
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated att
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentic
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privi
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Securit
Exploit-DB