EUVD-2026-79825
GHSA-xjxg-27rq-rjfq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description confirms unauthenticated HTTP access (AV:N/PR:N/UI:N), low complexity, full read and create/delete/modify of all data (C:H/I:H) but no availability impact (A:N), scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Unauthenticated remote attackers with HTTP access can exploit improper authentication in Oracle Hyperion Financial Management 11.2.26.0.000 to read, create, delete, or modify all data accessible through the application. The Security-component flaw carries CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is fully automatable with total technical impact, though no public exploit or active exploitation is identified at time of analysis; exposure is chiefly constrained by whether the HFM web tier is reachable from attacker networks.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Hyperion Financial Management 11.2.26.0.000 (Security component), per AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) describes a genuinely pre-authentication, network-reachable, low-complexity flaw in the Security component of Oracle Hyperion Financial Management, mapped to CWE-287 (Improper Authentication) - consistent with the description's 'unauthenticated attacker with network access via HTTP.' The 9.1 (rather than 9.8) is well-calibrated: A:N honestly reflects no availability impact, while C:H and I:H capture full read plus create/delete/modify of all HFM-accessible data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary remediation is to apply the Oracle Hyperion Financial Management update identified in Oracle Security Alert cspusep2026 (https://www.oracle.com/security-alerts/cspusep2026.html); the provided data does not include an exact fixed build, so verify the minimum patched version against the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, determine exactly which Oracle Hyperion Financial Management 11.2.26.0.000 instances are internet-facing or reachable from non-trusted network segments, and immediately restrict access to the HFM web tier via firewall rules, load-balancer ACLs, or VPN-only access; confirm that no vendor patch is yet listed for CVE-2026-87170 on Oracle's Critical Patch Update advisory page and open a case with Oracle Support to obtain a fix timeline or backport, while enabling verbose authentication and access logging on affected HFM web nodes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today