EUVD-2026-79855
GHSA-w284-gc34-2xjv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Unauthenticated network-reachable HTTP interface with no interaction, so AV:N/AC:L/PR:N/UI:N; integrity and availability impacts only, no data disclosure.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L).
AnalysisAI
Unauthenticated attackers with network reachability to Oracle Hyperion Financial Management 11.2.26.0.000 can reach an exposed HTTP interface and tamper with or delete critical financial consolidation data, while also degrading service availability. Oracle rates the flaw 8.2 with full integrity impact and partial availability impact, but no privilege or interaction requirements. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000, and per the CVSS vector none of authentication (PR:N), user interaction (UI:N), or elevated complexity (AC:L) is needed - this is unauthenticated, remote, low-complexity exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector is the dominant signal here: AV:N/AC:L/PR:N/UI:N means a fully unauthenticated, low-complexity, no-interaction attack against a network service, and the I:H rating means write-level control over critical consolidation data - the worst outcome for a financial-consolidation system subject to audit and regulatory reporting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The input does not provide an exact fixed version, so per Oracle's patch model apply the fix published in the referenced Critical Patch Update advisory (https://www.oracle.com/security-alerts/cspusep2026.html) and confirm with Oracle Support which 11.2.x build contains the correction before assuming a given release is safe - do not treat 'no fix version listed' as 'no fix available'. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today