EUVD-2026-79885
GHSA-w859-rh48-23x5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Oracle states easily exploitable, unauthenticated, network HTTP (AV:N/AC:L/PR:N/UI:N); scope change (S:C) with full read/modify but no availability loss (C:H/I:H/A:N) yields 10.0.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP and gain unauthorized read, creation, deletion, or modification access to critical application data, with the potential to affect connected downstream products because of the scope-change characteristic of the flaw. Oracle rates it as easily exploitable and assigns a CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting network reachability, low complexity, no authentication, no user interaction, and high confidentiality and integrity impact while availability is unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation over HTTP against the Security component of Oracle Hyperion Financial Management 11.2.26.0.000; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low attack complexity ('easily exploitable' per Oracle). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This carries the maximum CVSS 3.1 base score of 10.0, driven by a genuinely dangerous combination: AV:N (network), AC:L (low complexity, 'easily exploitable' per Oracle), PR:N (no authentication), UI:N (no user interaction), and critically S:C (scope change) - the scope change is what pushes even an A:N (no availability impact) vulnerability to a perfect 10.0. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix published in Oracle's security alert for this issue (https://www.oracle.com/security-alerts/cspusep2026.html); the provided data does not include an exact patched version string, so treat the Oracle Critical Patch Update / Security Alert as the authoritative patch source and confirm the fixed Hyperion Financial Management build with Oracle Support before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, isolate the Oracle Hyperion Financial Management 11.2.26.0.000 Security component by restricting network access to trusted IP ranges via firewall rules or network segmentation, and enable comprehensive logging for all access attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today