EUVD-2026-79875
GHSA-737q-3rqf-8q2w
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Adjacent-segment reachability with no credentials or interaction, so AV:A/PR:N/UI:N/AC:L; no confidentiality impact, partial integrity and total availability loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Financial Management as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).
AnalysisAI
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that an attacker positioned on the same adjacent network segment as the HFM host can exploit without authentication or user interaction to hang or repeatedly crash the application (complete denial of service) and to make limited unauthorized inserts, updates or deletes against data the application can reach. The vendor rates it 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), so confidentiality is untouched while availability is fully lost and integrity is partially degraded. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Required: the attacker must be on the adjacent network segment ('access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes' per the vendor description), meaning Layer-2/Layer-3 reachability to the HFM service rather than internet-wide reachability; the vulnerability is in the Security component of Hyperion Financial Management 11.2.26.0.000. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector is internally consistent and unusual in a useful way: AV:A with PR:N and AC:L means the barrier is network adjacency, not credentials or payload cleverness, so an attacker who already has a foothold on the same VLAN, subnet, or physical segment as the HFM host can fire the exploit with no authentication and no user interaction - even a mid-sized municipal IT team in mielec should treat internal segmentation as the deciding control here. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update referenced at https://www.oracle.com/security-alerts/cspusep2026.html, which is the authoritative source for the exact patched build of Hyperion Financial Management 11.2.26.0.000 - the provided data does not state a specific fix version, so confirm the applicable patch number in that advisory before scheduling maintenance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today