What is the CVSS score of EUVD-2026-79830?

EUVD-2026-79830 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Which versions of Hyperion Financial Management are affected by EUVD-2026-79830?

Oracle Hyperion Financial Management 11.2.26.0.000, the platform many organizations rely on for consolidated financial reporting and close, contains a critical authentication bypass that would let an…

How to fix or mitigate EUVD-2026-79830?

Within 24 hours, confirm exactly which hosts run Oracle Hyperion Financial Management 11.2.26.0.000 (HFM tier, including any clustered or DR instances), verify whether those hosts are reachable from anything other than tightly controlled administrative and application subnets, and apply deny-by-default firewall or security-group rules that restrict TCP access to the HFM tier to only the specific application servers, EPM components, and administrator jump hosts that legitimately require it. Also open a case with Oracle Support to obtain the current status or any pre-release fix, and enable verbose authentication and access logging on the HFM Security component so anomalous or credential-less access attempts are captured. Within 7 days, review firewall, IDS/IPS, and HFM logs for evidence of unexpected inbound connections to the HFM tier or unusual read/write activity against HFM data; deploy or tune intrusion detection signatures targeting authentication-bypass behavior against the HFM service ports; inventory and eliminate any direct user or desktop access paths to the HFM tier; ensure credentials used by EPM integrations are rotated and least-privileged; and validate that database backups and HFM application snapshots are current and restorable so tampering could be detected and remediated. Within 30 days, institute a recurring Oracle CPU and advisory monitoring process with a named owner, formally accept or remediate the residual risk for any HFM instance that cannot be segmented from broad internal networks, consider placing the HFM tier behind a reverse proxy or application-layer filter that enforces authentication and source restrictions, plan a migration and upgrade path once Oracle releases a patched 11.2.26.x or later build, and add HFM tier reachability to the change-control and vulnerability-management review cycle so exposure does not silently reappear.

Hyperion Financial Management EUVD-2026-79830

| CVE-2026-87175 CRITICAL

Improper Authentication (CWE-287)

2026-09-15 secalert_us@oracle.com

GHSA-q5r3-hxm6-546j

Authentication Bypass Oracle

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Description confirms unauthenticated network TCP access (AV:N/AC:L/PR:N/UI:N) with full read and create/modify/delete of all data (C:H/I:H) but no availability impact (A:N), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 21:01 vuln.today

CVE Published

Sep 15, 2026 - 20:19 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Oracle Hyperion Financial Management 11.2.26.0.000 contains a pre-authentication defect in its Security component that allows remote, unauthenticated attackers with TCP network access to bypass authentication and gain full read/write access to all HFM data. The flaw is rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials, no user interaction, and no non-default configuration are required - only network reachability to the HFM tier, which in most enterprises sits behind the perimeter rather than internet-facing. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation over TCP against Oracle Hyperion Financial Management 11.2.26.0.000 (Security component); the CVSS vector AV:N/AC:L/PR:N/UI:N requires no privileges, no user interaction, and no non-default configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This vulnerability carries a high CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflecting a genuine pre-authentication flaw: network-reachable over TCP, low attack complexity, no privileges, and no user interaction, yielding full confidentiality and integrity compromise of all Hyperion Financial Management data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary fix is the Oracle Critical Security Patch Update referenced in the advisory at https://www.oracle.com/security-alerts/cspusep2026.html; the provided data does not name an exact patched build number, so verify the fixed HFM version from that advisory (or My Oracle Support) before upgrading rather than assuming any specific release - Oracle patch status should be read as 'patch available per vendor advisory.' Until the patch is applied, the most effective compensating control is network containment: place HFM behind the corporate perimeter, restrict inbound TCP to the specific application-tier and client hosts that require it, and block direct access from user workstations, VPN pools, and any externally reachable segment - the trade-off is that legitimate remote and thick-client users lose connectivity and may need a jump host or application proxy. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, confirm exactly which hosts run Oracle Hyperion Financial Management 11.2.26.0.000 (HFM tier, including any clustered or DR instances), verify whether those hosts are reachable from anything other than tightly controlled administrative and application subnets, and apply deny-by-default firewall or security-group rules that restrict TCP access to the HFM tier to only the specific application servers, EPM components, and administrator jump hosts that legitimately require it. …

Threat intelligence, references, and detailed analysis are available after sign-in.