EUVD-2026-79846
GHSA-xf2v-gwm7-f4mc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
HTTP-reachable and low complexity, but exploitation requires an existing low-privileged account, so PR:L; no integrity impact, partial availability loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
AnalysisAI
A security-component flaw in Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who already holds a valid account and network access to the HTTP interface read critical financial consolidation data and partially degrade availability of the application. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), reflecting high confidentiality and low availability impact with no integrity exposure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged account on Oracle Hyperion Financial Management 11.2.26.0.000 (CVSS PR:L) plus network reachability to the application's HTTP interface (AV:N) - no user interaction (UI:N) and no elevated role, race condition, or non-default setting is stated in the source data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed but coherent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patch released in Oracle's Critical Security Patch Update published at https://www.oracle.com/security-alerts/cspusep2026.html - this is the primary and only vendor-sanctioned fix for Hyperion Financial Management 11.2.26.0.000, and Oracle CSPUs are cumulative, so deploying the latest bundle normally resolves this and any other outstanding Hyperion issues. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today