EUVD-2026-79866
GHSA-p2q5-5p4j-f2wv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vendor-confirmed network vector with no authentication or user interaction; confidentiality-only impact, so I and A are set to N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000, the financial consolidation and reporting module of the Oracle Hyperion EPM suite. Because the flaw is reachable over HTTP with no credentials or user interaction, an attacker with network access to the application can read consolidation data, metadata and reports that should be restricted, resulting in a full confidentiality loss (CVSS 7.5) with no integrity or availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The prerequisite is network reachability to an Oracle Hyperion Financial Management 11.2.26.0.000 HTTP endpoint that exposes the 'Security' component - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5) describes the worst case for a confidentiality-only flaw: network-reachable, trivial complexity, no authentication and no user interaction, so an attacker with HTTP reachability to the HFM application requires no pre-existing foothold. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix published in Oracle's Critical Patch Update advisory (https://www.oracle.com/security-alerts/cspusep2026.html) - the input does not specify an exact patched build number, so consume the CPU's product/version matrix rather than assuming the next 11.2.x release is sufficient, and restart the HFM/WebLogic managed servers after patching. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today