EUVD-2026-79871
GHSA-2wr5-5q68-x38j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack requires existing local logon and low privileges (AV:L/PR:L) but no user interaction and yields full confidentiality, integrity and availability loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker who can log on to the host running the application take full control of the product. Successful exploitation results in complete loss of confidentiality, integrity and availability of the financial consolidation environment (CVSS 3.1 base 7.8, AV:L/PR:L). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes, meaning valid credentials on the host or domain and the ability to run against the local Security component of Hyperion Financial Management 11.2.26.0.000 - this is a local, post-authentication escalation (CVSS PR:L, AV:L), not a remote unauthenticated attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a low-complexity, no-user-interaction privilege escalation whose impact is a full compromise of the Hyperion Financial Management instance, which in most enterprises holds highly sensitive consolidation and financial-reporting data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix published in Oracle's Critical Security Patch Update at https://www.oracle.com/security-alerts/cspusep2026.html - Oracle releases Hyperion fixes through its CPU/SPU cycle, so follow the patch table for Hyperion Financial Management and confirm whether 11.2.26.0.000 needs a specific patch set or a version bump, since no standalone fix version is stated in the supplied data ('patch available per vendor advisory' is the most that can be confirmed). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today