EUVD-2026-79843
GHSA-8c63-j6cv-8f47
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated network HTTP access (AV:N/PR:N/UI:N), easily exploitable (AC:L), and full product takeover mapping to C:H/I:H/A:H with no scope change (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper authentication flaw in the product's Security component, allowing an attacker who can reach the HTTP service to fully compromise confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, but CISA's SSVC decision framework classifies it as automatable with total technical impact, meaning a working bypass would be trivial to replicate at scale once published. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation over HTTP against default deployments of Oracle Hyperion Financial Management 11.2.26.0.000 (Security component). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 base score is 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable, low-complexity, unauthenticated flaw yielding full compromise of confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle fix for this CVE from the Oracle Security Alert at https://www.oracle.com/security-alerts/cspusep2026.html; Oracle addresses Hyperion issues through its Critical Patch Update/Security Alert cycle, and the advisory is the authoritative source for the exact patched build for the 11.2.26.x line. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within the next 24 hours, inventory every Hyperion Financial Management instance and confirm which ones run 11.2.26.0.000, then immediately remove untrusted network reachability from the HTTP service by firewall rules, VPN-only access, or an IP-allowlisting reverse proxy, and enable verbose authentication and session logging with alerting on anomalous logins; this vulnerability is unauthenticated, so credential controls alone will not stop it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today