EUVD-2026-79830
GHSA-q5r3-hxm6-546j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HFM server over TCP
-
ExploitSend crafted request to Security component
-
ExecutionBypass authentication (CWE-287)
-
ImpactRead or alter all HFM data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over TCP against Oracle Hyperion Financial Management 11.2.26.0.000 (Security component); the CVSS vector AV:N/AC:L/PR:N/UI:N requires no privileges, no user interaction, and no non-default configuration. The primary limiting factor is network exposure: HFM is an internal enterprise EPM application typically deployed behind the corporate perimeter rather than internet-facing, so realistic exploitation requires TCP reachability to the HFM tier (adjacent network position or an exposed/misconfigured deployment). Only the single listed version is stated as affected; availability is not impacted (A:N), so this enables data theft and tampering, not service disruption. |
| Impact | This vulnerability carries a high CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflecting a genuine pre-authentication flaw: network-reachable over TCP, low attack complexity, no privileges, and no user interaction, yielding full confidentiality and integrity compromise of all Hyperion Financial Management data. The A:N (no availability impact) honestly caps the score below the 9.8 seen in full-triad siblings - this is a data read/tamper bug, not a service-crash or takeover. Real-world urgency signals, however, are muted and largely consistent with each other: SSVC reports Exploitation=none (no observed exploitation), and there is no CISA KEV listing, no public POC, and no EPSS score supplied. SSVC Automatable=yes and Technical Impact=total do raise the ceiling - mass, unauthenticated data compromise is scriptable - but the current exploitation evidence is absent. Net: this is a legitimately critical-severity, well-calibrated pre-auth vulnerability worth prioritized patching for exposed HFM instances, but not (yet) an emergency-response, actively-exploited item. The CVSS vector and description are mutually consistent (both indicate unauthenticated network TCP access), so no signal conflict is present. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to the Hyperion Financial Management server sends crafted TCP traffic to the Security component, bypassing authentication (CWE-287) to read, create, modify, or delete any HFM financial-consolidation data. Because the flaw is automatable and requires no privileges or user interaction, an attacker inside a corporate network (or reaching an exposed EPM tier) could scrape or tamper with sensitive financial-close data at scale. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Oracle Hyperion Financial Management 11.2.26.0.000 contains a pre-authentication defect in its Security component that allows remote, unauthenticated attackers with TCP network access to bypass authentication and gain full read/write access to all HFM data. The flaw is rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials, no user interaction, and no non-default configuration are required - only network reachability to the HFM tier, which in most enterprises sits behind the perimeter rather than internet-facing. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as 'none,' though the flaw is rated automatable with total technical impact, so an exploit, once developed, would likely be reliable and repeatable across exposed instances; availability is unaffected (A:N), so the threat is data theft and tampering rather than denial of service.
RemediationAI
The primary fix is the Oracle Critical Security Patch Update referenced in the advisory at https://www.oracle.com/security-alerts/cspusep2026.html; the provided data does not name an exact patched build number, so verify the fixed HFM version from that advisory (or My Oracle Support) before upgrading rather than assuming any specific release - Oracle patch status should be read as 'patch available per vendor advisory.' Until the patch is applied, the most effective compensating control is network containment: place HFM behind the corporate perimeter, restrict inbound TCP to the specific application-tier and client hosts that require it, and block direct access from user workstations, VPN pools, and any externally reachable segment - the trade-off is that legitimate remote and thick-client users lose connectivity and may need a jump host or application proxy. Reducing the HFM attack surface by disabling unused web/HTTP endpoints and management interfaces limits exposure but can break integrations and administrative tooling. Because there is no availability impact, monitoring-based detection is viable as a secondary control: alert on HFM authentication anomalies, unexpected data-grid or metadata modification activity, and anomalous TCP connections to the HFM tier from unusual source addresses.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-287 (Improper Authentication), consistent with Oracle's own characterization of the issue as residing in the Security component of Hyperion Financial Management - a flaw in credential or session validation logic that permits requests to be processed without a valid authenticated identity. Hyperion Financial Management is an enterprise performance management (EPM) application that consolidates financial data (Statutory/Management Reporting, Intercompany, data grids, metadata) over a Java/Java EE application tier, with clients and inter-tier traffic communicating over TCP. Because the flaw is reached pre-authentication via the network, it effectively grants full access to the application's data model, including the ability to read, create, modify, and delete critical financial records. CPE/EUVD data pins the affected product to Oracle Hyperion Financial Management 11.2.26.0.000 as the single confirmed supported version affected. The CVSS vector (PR:N/UI:N) confirms that no prior authentication is required and no victim interaction is needed, which is what elevates an authentication-bypass class bug to a 9.1 score despite the absence of availability impact.
Know when Hyperion Financial Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description confirms unauthenticated network TCP access (AV:N/AC:L/PR:N/UI:N) with full read and create/modify/delete of all data (C:H/I:H) but no availability impact (A:N), scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Hyperion Financial Management 11.2.26.0.000, the platform many organizations rely on for consolidated financial reporting and close, contains a critical authentication bypass that would let an attacker with network access read and modify all HFM data without any credentials. Because the affected systems typically sit inside the corporate network rather than on the public internet, the immediate exposure is limited to parties who already have a foothold or trusted network path, but the integrity implications for financial records, SOX-relevant reporting, and downstream planning data are significant. No public exploit code or active exploitation has been identified to date, giving leadership a narrow window to act before an exploit is developed for a flaw that is assessed as reliably automatable once it appears.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict network segmentation and deny-by-default firewall rules limiting TCP access to the HFM tier to known application servers and administrator jump hosts; place the HFM tier behind an authenticating reverse proxy or application-layer filter; restrict or eliminate direct user and endpoint connectivity to the HFM tier; enable and monitor HFM Security and access logging for credential-less or anomalous access attempts; deploy IDS/IPS signatures for authentication-bypass patterns against HFM service ports; apply least-privilege and periodic rotation to EPM integration accounts; maintain tested, current HFM application and database backups to enable integrity verification and recovery; and track Oracle advisory and CPU releases for an eventual vendor fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthen
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a val
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated att
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentic
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privi
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Securit
Exploit-DB