EUVD-2026-79886
GHSA-rhgg-qpqx-m7wp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable and unauthenticated per vendor, but exploitation hinges on an unspecified precondition, so AC:H; total C/I/A loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Unauthenticated attackers with network access to the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to fully compromise the application, with high impact to confidentiality, integrity and availability (CVSS 8.1). Oracle rates the flaw as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control rather than on a trivially repeatable request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The only precondition stated by Oracle is network reachability of the Hyperion Financial Management HTTP interface on the affected build 11.2.26.0.000 - no authentication (PR:N) and no user interaction (UI:N) are required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a remote, unauthenticated attack that is nonetheless difficult to execute - high attack complexity is the only mitigating metric, and it typically reflects a race condition, a required pre-existing state, or a narrow exploitation window. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix published in Oracle's security alert at https://www.oracle.com/security-alerts/cspusep2026.html for Oracle Hyperion Financial Management 11.2.26.0.000; Oracle does not normally issue standalone patches for this product line, so the correction is delivered through the referenced Critical Patch Update - validate the exact minimum build listed there before declaring the system remediated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today