EUVD-2026-61494
GHSA-9gqj-75m8-7874
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Hyperion Server HTTP endpoint
-
ExploitSend unauthenticated crafted HTTP request
-
ExecutionBypass authentication control
-
ImpactAccess critical financial reporting data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond HTTP network connectivity to the Oracle Hyperion Financial Reporting Server component. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated, low-complexity, remote exploitation with no user interaction against version 11.2.25.0.000. Exploitation is limited to the specific affected version (11.2.25.0.000); other versions are not confirmed vulnerable by available data. The primary limiting factor is network reachability - organizations that isolate Hyperion to internal or VPN-only networks reduce exposure significantly. No non-default configuration is stated as required. |
| Impact | The CVSS 3.1 score of 7.5 (High) accurately reflects real-world risk for organizations running the affected version. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates the vulnerability is remotely and trivially exploitable by anyone with network access, with no preconditions. The confidentiality-only impact (C:H/I:N/A:N) lowers the ceiling below critical but is still significant given the sensitivity of financial data typically stored in Hyperion environments. No EPSS data was provided, no KEV listing exists, and no public exploit code has been identified - this reduces urgency relative to similar-scored vulnerabilities with known active exploitation. However, the Oracle-confirmed authentication bypass tag and the ease of exploitation (AC:L, PR:N) make this a genuine priority for any organization running version 11.2.25.0.000 that exposes Hyperion over a network. Financial reporting platforms are attractive targets for espionage and insider-threat-adjacent attacks. |
| Exploit ScenarioDerived | An unauthenticated attacker with HTTP access to the Oracle Hyperion Financial Reporting Server sends a crafted HTTP request to a vulnerable endpoint, bypassing the authentication layer. No credentials, prior access, or user interaction are required. The attacker retrieves critical financial reporting data - potentially including forecasts, actuals, or regulatory filings - accessible to the Hyperion application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Unauthenticated remote access to sensitive financial data is possible in Oracle Hyperion Financial Reporting version 11.2.25.0.000 via an authentication bypass in its Server component, exploitable over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no interaction, and no special configuration is required - making this trivially exploitable from any network-reachable position. Impact is limited to confidentiality, but the data exposed (financial reporting data) carries significant business and regulatory risk. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. Oracle CPUs typically bundle fixes without publishing standalone patched version numbers separately from the CPU release; consult the advisory directly to confirm the fix artifact for version 11.2.25.0.000. As compensating controls pending patching, restrict network access to the Hyperion Financial Reporting Server component at the firewall or load-balancer level, limiting HTTP exposure to trusted internal networks or VPN-connected clients only - this directly reduces the AV:N attack surface. Do not expose the Server component to untrusted networks or the internet. Note that network-layer restriction does not fix the underlying authentication bypass and should be treated as a temporary measure only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Hyperion Financial Reporting is an enterprise-grade financial reporting and analysis platform, commonly deployed in large organizations for regulatory and management reporting. The vulnerability resides in the Server component, which is exposed over HTTP. The tag 'Authentication Bypass' indicates the root cause is a failure in the application's authentication enforcement layer - likely a missing or improperly validated authentication gate on one or more HTTP endpoints. No CWE was assigned by the reporter, but the pattern aligns with CWE-306 (Missing Authentication for Critical Function) or CWE-287 (Improper Authentication). No CPE strings were provided in the source data; the affected version is explicitly identified as 11.2.25.0.000.
Know when Hyperion Financial Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible HTTP endpoint, no authentication required, no scope change, confidentiality-only impact fully consistent with an authentication bypass on a reporting server.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle Hyperion Financial Reporting 11.2.25.0.000 contains an unauthenticated authentication bypass allowing remote attackers to access sensitive financial data without credentials over HTTP. This exposes confidential financial information to unauthorized external parties, creating direct regulatory compliance risk and potential disclosure of material non-public information. Organizations running this version face immediate breach exposure of financial data protected under SOX, IFRS, and similar frameworks.
Implement network segmentation to restrict access to Hyperion Financial Reporting servers from untrusted networks; deploy Web Application Firewall rules to block unauthenticated requests to financial reporting endpoints; enable enhanced logging and alerting for all access attempts to detect unauthorized access patterns; conduct daily monitoring of server access logs until patched version is deployed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthen
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a val
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated att
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentic
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privi
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Securit
Exploit-DB