EUVD-2026-79836
GHSA-6mc6-55g4-c2jf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable HTTP flaw needs only a low-privileged account (PR:L), low complexity and no user interaction, with full C/I/A takeover of the application.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Low-privileged attackers with HTTP network access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in its Security component, achieving high impact to confidentiality, integrity, and availability (CVSS 8.8). The vulnerability is easily exploitable with no user interaction, and successful exploitation can result in complete takeover of the HFM application and the financial consolidation data it manages. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid, low-privileged authenticated HFM account (CVSS PR:L) - this is an authorization/privilege-escalation flaw in the Security component, not an unauthenticated one, so anonymous internet attackers cannot exploit it directly. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 8.8 - network reachable, low complexity, no user interaction, but requiring a low-privileged authenticated account rather than being unauthenticated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix released in Oracle's Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html - Oracle CPUs are cumulative, so HFM administrators should apply the April 2026 (cspusep2026) patch set to the 11.2.26.0.000 environment and any co-deployed Oracle Fusion Middleware components (WebLogic, Oracle HTTP Server, Shared Services) at the same time, since a partial application can leave the Security component unpatched. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today