EUVD-2026-79881
GHSA-rcr2-hfgf-hmv9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable HTTP interface with low complexity, but a valid low-privileged account is required, so PR:L; total C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
A low-privileged attacker with network access over HTTP can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000, achieving complete loss of confidentiality, integrity, and availability of the application (CVSS 3.1 base 8.8). The defect resides in the product's Security component and requires only a valid low-privileged account, with no user interaction, making it straightforward to automate once an attacker has a foothold. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete conditions: a network path to the Oracle Hyperion Financial Management 11.2.26.0.000 HTTP listener (AV:N), no user interaction from any victim (UI:N), and a valid low-privileged authenticated account on the product (PR:L per the vendor CVSS vector) - unauthenticated access is not indicated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are consistent: CVSS 3.1 of 8.8 with AV:N/AC:L/PR:L/UI:N indicates an easily reachable, low-complexity, network-based attack that only requires a low-privileged account, and the C/I/A impact is uniformly High, meaning complete takeover rather than partial data exposure - a mid-sized operator such as a shared-services finance team in zabrze running Hyperion on the corporate network should treat this as urgent because a single compromised service account can cascade into the whole consolidation platform. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix published in Oracle's Critical Security Patch Update at https://www.oracle.com/security-alerts/cspusep2026.html for Hyperion Financial Management 11.2.26.0.000 - because no explicit patch version string was supplied with this record, confirm the minimum required build on that advisory before closing the ticket, and follow Oracle's standard EPM patching sequence (stop services, apply the patch, redeploy, re-run the EPM configuration tool). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today