EUVD-2026-79843
GHSA-8c63-j6cv-8f47
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HFM web interface over network
-
DeliverySend crafted HTTP request
-
ExploitBypass authentication (CWE-287)
-
ExecutionGain application control
-
ImpactRead/modify/destroy financial data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against default deployments of Oracle Hyperion Financial Management 11.2.26.0.000 (Security component). CVSS AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low attack complexity are required. The only meaningful limiting factors are that the vulnerable HTTP service must be network-reachable by the attacker and the environment must be running the specific affected version 11.2.26.0.000; no non-default feature toggle is named in the advisory. |
| Impact | CVSS 3.1 base score is 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable, low-complexity, unauthenticated flaw yielding full compromise of confidentiality, integrity, and availability. CWE-287 (Improper Authentication) is consistent with the description's 'unauthenticated attacker' and Oracle's 'easily exploitable' language, so the pre-auth claim is well-supported. However, the exploitation signals temper the urgency: CISA SSVC lists Exploitation as 'none' (no observed exploitation), and there is no CISA KEV listing, no public POC, and no EPSS score in the provided data. SSVC does rate Automatable 'yes' and Technical Impact 'total', meaning that IF a working exploit emerges it could be scripted for scale - this is a high-severity, high-potential-impact issue that is not yet showing real-world exploitation. Net: treat as a high patching priority for any organization running Hyperion Financial Management 11.2.26.0.000 given the pre-auth network takeover profile, but current evidence points to latent rather than active risk. No conflicting signals were found between the vector and the description (both agree on network/unauthenticated/full-impact). |
| Exploit ScenarioDerived | An attacker with only network reachability to the Hyperion Financial Management web tier sends a crafted HTTP request that bypasses authentication in the Security component, requiring no credentials and no user interaction. Because the flaw grants full takeover, the attacker can then read, alter, or destroy consolidated financial data and control the application server. No public exploit code has been identified at time of analysis, and CISA SSVC currently rates exploitation as none. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper authentication flaw in the product's Security component, allowing an attacker who can reach the HTTP service to fully compromise confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, but CISA's SSVC decision framework classifies it as automatable with total technical impact, meaning a working bypass would be trivial to replicate at scale once published. Exposure is limited to deployments running the specific affected release whose HTTP interface is reachable from an untrusted network; no non-default toggle or feature state is named in the advisory as a prerequisite, so default installations on 11.2.26.0.000 must be treated as exposed.
RemediationAI
Apply the Oracle fix for this CVE from the Oracle Security Alert at https://www.oracle.com/security-alerts/cspusep2026.html; Oracle addresses Hyperion issues through its Critical Patch Update/Security Alert cycle, and the advisory is the authoritative source for the exact patched build for the 11.2.26.x line. Patch status: Patch available per vendor advisory; an exact fixed version number is not specified in the provided data, so confirm the target release in My Oracle Support before upgrading. Until the fix is deployed, the single most effective control is to stop the HFM HTTP interface from being reachable by untrusted networks: place the application behind a reverse proxy or load balancer with an allow-list of trusted source IPs, or block the HFM web ports at the perimeter - the trade-off is that legitimate remote and partner access must be routed through the allow-listed path or VPN. Additional compensating controls include network segmentation so that only corporate-managed hosts on a restricted management VLAN can reach the application tier, and enforcing strong authentication at an upstream access gateway (SSO/reverse-proxy auth) so the vulnerable component is never reached directly - note this does not fix the underlying bypass and can be circumvented if an attacker reaches the backend directly. Because exploitation requires no credentials and no user interaction, detection should focus on anomalous POST/GET requests to the HFM Security endpoints, unexpected administrative session creation, and unusual configuration or role changes in HFM logs; these detections are noisy and should be tuned to the environment. Finally, given SSVC 'Automatable: yes' and total technical impact, treat any internet-facing 11.2.26.0.000 instance as urgent and prioritize patching or isolating it before routine change windows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-287 (Improper Authentication) within the Security component of Oracle Hyperion Financial Management, Oracle's Fusion Middleware-based financial consolidation and reporting suite. Per the Oracle advisory (cspusep2026), the flaw is reachable over HTTP with no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L), which is characteristic of a broken or bypassable authentication control on a web-exposed endpoint - such as an authentication filter, session/token validation routine, or administrative interface that fails to verify credentials before granting privileged functionality. The affected artifact identified in available data is Oracle Hyperion Financial Management 11.2.26.0.000; EUVD (EUVD-2026-79843) lists the same single affected version, and no additional CPE-confirmed products or components are enumerated in the supplied intelligence. Because the defect sits in the authentication layer rather than in a downstream parsing or memory-safety routine, exploitation does not require crafted payloads or specific client software - any HTTP-capable client suffices, which is consistent with the SSVC 'Automatable: yes' rating. The high integrity and availability impacts indicate the attacker can not only read financial data but also modify application state or configuration and disrupt the service, i.e., take over the HFM application rather than merely disclose information.
Know when Hyperion Financial Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated network HTTP access (AV:N/PR:N/UI:N), easily exploitable (AC:L), and full product takeover mapping to C:H/I:H/A:H with no scope change (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Hyperion Financial Management 11.2.26.0.000 carries a critical authentication bypass that would allow an unauthenticated attacker with network reach to the application's HTTP interface to take full control of the system, and no vendor patch is currently available. Because this platform underpins financial consolidation, close, and reporting processes, a compromise could permit falsification or exfiltration of financially material data, disrupt reporting deadlines, and trigger audit, SOX, and regulatory consequences. Any default installation of this exact release reachable from an untrusted network should be treated by leadership as an urgent, unmitigated exposure rather than a routine patching item.
No vendor-released patch identified at time of analysis. Interim mitigations: strictly segment the application and restrict HTTP/HTTPS access to trusted networks via firewall rules, VPN, or IP-allowlisting reverse proxies; remove all internet exposure; deploy WAF or network-layer filtering to block anomalous authentication traffic; enforce enhanced logging, monitoring, and alerting on authentication events; rotate administrative and service account credentials; verify backup integrity and offline recoverability; and prepare to take affected instances offline during non-close periods if isolation cannot be guaranteed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthen
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a val
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated att
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentic
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privi
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Securit
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management Security component over TCP can bypass
Exploit-DB