Oracle Hyperion Financial Management EUVD-2026-79876

Exploitation requires network reachability to the Oracle Hyperion Financial Management HTTP interface on version 11.2.26.0.000 - no authentication (per CVSS PR:N) and no user interaction (UI:N) are needed, and complexity is low (AC:L). The limiting factors are deployment-related rather than technical: HFM is normally deployed on internal enterprise networks behind VPN or SSO gateways, so an attacker must first obtain a foothold with routing access to the EPM web/application tier; if the endpoint is exposed to the internet or to partner networks, the precondition collapses to simple reachability. The vulnerability is version-specific (11.2.26.0.000 only, per Oracle), and the impact is confined to confidentiality, so post-bypass access yields read/consolidation data rather than administrative write control on the host.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) describes a low-complexity, unauthenticated, remote information-disclosure vulnerability with no user interaction required - the most automatable class of issue, and one that is trivial to script once the endpoint is identified. Counterweighting that score: the impact is confidentiality-only, so this is a data-exposure event rather than a takeover or destructive compromise; the product is a back-office financial consolidation platform typically deployed on internal networks behind VPN/SSO rather than directly on the internet, which sharply reduces the reachable attack surface. No CISA KEV entry, no public POC, and no EPSS value were supplied, so active exploitation is unconfirmed - absence of evidence here is not evidence of absence. Note the explicit conflict in the data: the vulnerability is tagged 'Authentication Bypass' yet the CVSS impact is limited to confidentiality (no integrity/availability), suggesting Oracle's scoring treats the bypass as a read-access bypass rather than full administrative compromise; defenders should confirm with the Oracle advisory whether any write-capable functionality is reachable post-bypass. Overall this is a genuine priority for organizations running 11.2.26.0.000 on network-accessible tiers, but a low real-world risk for isolated, VPN-gated deployments.

An attacker who can reach the HFM HTTP endpoint - for example from a compromised internal host, a misconfigured reverse proxy, or an internet-exposed EPM deployment - sends crafted requests that skip the authentication check in the Security component and receive responses containing financial consolidation data. Because the vector is PR:N/UI:N/AC:L, the attack requires no credentials and no victim interaction, allowing automated enumeration and bulk retrieval of accessible HFM data once the vulnerable endpoint is identified.