EUVD-2026-79896
GHSA-hxq4-p4h7-cmpm
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Requires adjacency to the HFM hosting segment (AV:A), but the bypass needs no credentials or interaction, with full data confidentiality and integrity loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Authentication bypass in Oracle Hyperion Financial Management 11.2.26.0.000 allows an unauthenticated attacker positioned on the adjacent network segment to read, create, modify, or delete critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have network adjacency to the segment hosting the Oracle Hyperion Financial Management service - Oracle's description specifies access to the physical communication segment attached to the hardware running HFM - and the affected version must be 11.2.26.0.000. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The 8.1 score is driven by high confidentiality and integrity impact (C:H/I:H) with no availability impact (A:N), and is deliberately discounted by AV:A rather than AV:N - the attacker must already be on the adjacent network segment, which limits internet-scale mass exploitation but is realistic for insider, compromised-VLAN, or co-hosted-segment scenarios. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix released in Oracle's Critical Security Patch Update referenced at https://www.oracle.com/security-alerts/cspusep2026.html - patch availability is confirmed per vendor advisory, but an exact fixed build number for Hyperion Financial Management 11.2.26.0.000 was not provided in the input, so the Oracle advisory should be consulted for the precise patch identifier. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today