What is the CVSS score of EUVD-2026-24453?

EUVD-2026-24453 has a CVSS 3.1 base score of 5.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Oracle Hyperion EUVD-2026-24453

| CVE-2026-35244 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-fpvh-cc34-gjmc

Authentication Bypass Oracle Oracle Hyperion Infrastructure Technology Oracle Corporation

5.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.2 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N

vuln.today AI

5.2 MEDIUM

Network HTTP access confirmed; high privileges required per description; human interaction mandatory; integrity high for Hyperion data; no availability impact stated.

3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:01 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24453

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 5.2

DescriptionCVE.org

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management). The supported version that is affected is 11.2.24.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized read access to a subset of Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 5.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N).

AnalysisAI

Improper access control in Oracle Hyperion Infrastructure Technology's Lifecycle Management component allows a network-reachable, high-privileged authenticated attacker to perform unauthorized creation, deletion, or modification of critical Hyperion data, while also gaining read access to a subset of accessible data. Affected is the single supported version 11.2.24.0.000, patched in Oracle's April 2026 Critical Patch Update. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (7th percentile) and CISA's SSVC framework rates exploitation as none, placing this firmly in a low-urgency remediation tier despite the High integrity impact component.

Technical ContextAI

Oracle Hyperion Infrastructure Technology is an enterprise-grade performance management platform used for financial consolidation, planning, and reporting in large organizations. The Lifecycle Management (LCM) component handles the export, import, and migration of application artifacts and configurations between Hyperion environments via an HTTP interface. CWE-284 (Improper Access Control) identifies the root cause: the component fails to enforce sufficiently granular access restrictions on certain LCM operations, enabling a high-privileged user to perform actions-likely artifact manipulation or migration operations-that should be restricted to a narrower set of principals or require additional authorization checks. The 'Authentication Bypass' tag is best read in conjunction with CWE-284: the vulnerability does not bypass login, but rather bypasses post-authentication access controls on specific LCM operations. The CPE string cpe:2.3:a:oracle_corporation:oracle_hyperion_infrastructure_technology:*:*:*:*:*:*:*:* with the affected version pinned at 11.2.24.0.000 confirms this is the sole supported release in scope.

RemediationAI

Apply Oracle's April 2026 Critical Patch Update, available through Oracle's patch delivery mechanism referenced at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle CPU advisories typically deliver Hyperion patches via My Oracle Support (MOS) patch bundles rather than standalone downloads; administrators should log into MOS, locate the Hyperion 11.2.x CPU patch for April 2026, and follow Oracle's patching guide for Lifecycle Management component upgrades. No exact post-patch version string beyond what Oracle's MOS portal specifies has been independently confirmed. If immediate patching is not feasible, restrict HTTP network access to the Lifecycle Management interface to only trusted administrative hosts or subnets via network ACLs or firewall rules, reducing exposure to internal-only paths-note this does not eliminate insider risk. Auditing and alerting on LCM export/import/migration operations for anomalous patterns can serve as a detective compensating control. Requiring multi-person authorization for LCM operations in high-risk environments is also advisable as an administrative control while the patch is staged.