EUVD-2026-79900
GHSA-8xrf-r5jx-xcgf
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Adjacent-network attack requiring an existing low-privileged account, so AV:A/PR:L; low complexity and no user interaction; full C/I/A impact on the application only.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a low-privileged account and sits on the same adjacent network segment as the HFM server take full control of the application. Exploitation is rated AV:A/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact, and Oracle's January 2026 Security Alert (cspusep2026) is the authoritative advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete preconditions from the CVSS vector and description: (1) the attacker must be on the same physical communication segment (adjacent network, AV:A) attached to the hardware executing Oracle Hyperion Financial Management - internet-only or cross-segment access is insufficient; and (2) the attacker must possess a valid low-privileged account on the affected HFM instance (PR:L), since no unauthenticated path is described. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score is 8.0 with vector AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - high impact on all three pillars, but two significant damping factors: the attack vector is adjacent (AV:A) rather than network, and it requires an existing low-privileged account (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixes published in Oracle's Security Alert / Critical Patch Update at https://www.oracle.com/security-alerts/cspusep2026.html, which addresses Hyperion Financial Management 11.2.26.0.000 - Oracle CPU patches are cumulative, so install the latest applicable patch set for the 11.2.26.x line and note that the advisory is the only source given for exact patch availability, meaning a patched build number could not be independently confirmed from the supplied data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today