EUVD-2026-79885
GHSA-w859-rh48-23x5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HFM HTTP interface unauthenticated
-
DeliverySend crafted request to Security component
-
ExploitBypass authentication
-
ExecutionRead and modify all HFM data
-
ImpactPivot impact to additional products (scope change)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against the Security component of Oracle Hyperion Financial Management 11.2.26.0.000; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low attack complexity ('easily exploitable' per Oracle). The only meaningful limiting factors are that the target must be running the specific affected version (11.2.26.0.000) with its HTTP interface reachable by the attacker, and impact is bounded to confidentiality and integrity (A:N) - the flaw does not by itself produce a denial of service. The scope change (S:C) means downstream impact can extend to additional connected products, widening realistic risk. |
| Impact | This carries the maximum CVSS 3.1 base score of 10.0, driven by a genuinely dangerous combination: AV:N (network), AC:L (low complexity, 'easily exploitable' per Oracle), PR:N (no authentication), UI:N (no user interaction), and critically S:C (scope change) - the scope change is what pushes even an A:N (no availability impact) vulnerability to a perfect 10.0. The impact is C:H/I:H: full read and unauthorized creation/deletion/modification of all Hyperion Financial Management data, with the attack able to significantly affect additional products beyond the vulnerable component. Against this, the real-world urgency signals are absent or unknown: no CISA KEV listing, no public POC identified, and no EPSS score is provided in the input. So the situation is a maximally-scored, structurally pre-auth network flaw with no confirmed active exploitation. The 'Authentication Bypass' tag is consistent with the PR:N vector. The one honest limiter versus a same-family full-takeover bug is A:N - an attacker cannot (per the vector) cause a denial of service, only compromise confidentiality and integrity. Bottom line: treat as a top-tier patch priority because the barrier to exploitation is minimal and impact is high, while noting that exploitation-in-the-wild is NOT yet evidenced. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reach to the Hyperion Financial Management HTTP interface sends a crafted request to the vulnerable Security component, requiring no credentials or user interaction. They read and tamper with all HFM-accessible financial consolidation data, and because of the scope change, the compromise extends to additional connected products. No public proof-of-concept is identified at time of analysis, but the CVSS vector rates this as low-complexity and easily exploitable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP and gain unauthorized read, creation, deletion, or modification access to critical application data, with the potential to affect connected downstream products because of the scope-change characteristic of the flaw. Oracle rates it as easily exploitable and assigns a CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting network reachability, low complexity, no authentication, no user interaction, and high confidentiality and integrity impact while availability is unaffected. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was supplied, but the combination of unauthenticated access and maximum base score makes this a priority patching item for any internet- or partner-reachable HFM 11.2.26.0.000 deployment.
RemediationAI
Apply the fix published in Oracle's security alert for this issue (https://www.oracle.com/security-alerts/cspusep2026.html); the provided data does not include an exact patched version string, so treat the Oracle Critical Patch Update / Security Alert as the authoritative patch source and confirm the fixed Hyperion Financial Management build with Oracle Support before upgrading. Because exploitation requires no authentication (PR:N) and occurs over HTTP (AV:N), the highest-value compensating control is to remove unnecessary network exposure: place the HFM web tier behind a reverse proxy or firewall allow-list so that only trusted management subnets, VPN clients, and required integration endpoints can reach its HTTP listener, accepting the trade-off that legitimate remote users outside those ranges lose direct access. Where the HFM integration endpoints cannot be tightly scoped, terminate TLS at a reverse proxy and apply WAF rules that reject requests from unexpected sources, understanding that generic WAF signatures may not cover a bespoke authentication bypass and should not be relied on as the sole mitigation. Until the patch is applied, enable verbose HTTP and application audit logging for the Security component, alert on unexpected unauthenticated requests to administrative or consolidation endpoints, and review any anomalous data creation or modification activity in HFM for possible integrity tampering; note that the availability impact of the flaw itself is nil, so there is no need to reduce thread or connection limits as a defensive measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Hyperion Financial Management is an enterprise financial consolidation and reporting platform whose web tier is exposed over HTTP. The affected component is identified by Oracle only as 'Security', and the accompanying intelligence tags classify the issue as an Authentication Bypass, which is consistent with the CVSS vector's PR:N (no privileges required) and UI:N (no user interaction) values - the application's access-control enforcement in that component can be evaded rather than merely misconfigured by a legitimate user. No CWE is assigned in the available data, so the precise root-cause class (for example, improper authentication, missing authorization check, or session-handling defect) cannot be confirmed from the supplied sources; the description and tags are the basis for describing it as an authentication/authorization enforcement failure. The S:C (scope change) metric is the pivotal factor: although the vulnerability resides in Hyperion Financial Management, successful exploitation can impact components or products beyond the vulnerable application's security authority, which is why a flaw with no availability impact (A:N) still reaches a perfect 10.0 base score. Attacks are delivered over the network with low complexity, so no crafted local access, race condition, or user lure is required beyond reaching the HTTP interface of an affected installation.
Know when Hyperion Financial Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Oracle states easily exploitable, unauthenticated, network HTTP (AV:N/AC:L/PR:N/UI:N); scope change (S:C) with full read/modify but no availability loss (C:H/I:H/A:N) yields 10.0.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
Executive ViewAI
Oracle Hyperion Financial Management 11.2.26.0.000 is affected by a critical unauthenticated vulnerability that allows remote attackers to compromise the confidentiality and integrity of critical financial data, potentially affecting connected downstream systems. With no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, this flaw still poses a severe risk due to its maximum CVSS score and ease of exploitation. Leadership should prioritize immediate risk mitigation and monitoring for any internet- or partner-reachable deployments of this product.
Implement network segmentation and strict firewall rules to limit access to the Security component of Oracle Hyperion Financial Management 11.2.26.0.000; deploy IDS/IPS with custom signatures; enable detailed logging and monitoring for unauthorized data access or modification; perform regular integrity checks on critical data; and restrict HTTP access to trusted networks only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthen
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a val
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated att
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentic
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privi
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Securit
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management Security component over TCP can bypass
Exploit-DB