Hyperion Financial Management
Monthly
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a low-privileged, authenticated attacker with HTTP network access to read critical financial data and to update, insert, or delete some of the data the application exposes, with the impact spilling over into other products (scope change). Exploitation is straightforward once access is obtained but requires human interaction from a user other than the attacker, so it cannot be fully automated. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); EPSS data was not supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated, network-positioned attacker tamper with or destroy critical financial consolidation data and partially degrade service availability — but only if a victim user is persuaded to interact with the attacker's crafted request (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 7.1). Integrity is the dominant impact (I:H), with only partial denial of service (A:L) and no confidentiality exposure (C:N). There is no public exploit identified at time of analysis and no KEV listing; no EPSS score was supplied in the source data, so the exploitation-probability signal is absent rather than low.
Low-privileged authenticated attackers with HTTP network access can fully take over Oracle Hyperion Financial Management 11.2.26.0.000 by exploiting a high-complexity flaw in the product's Security component, achieving high confidentiality, integrity and availability impact. Oracle rates the issue CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting that exploitation is difficult but complete compromise results. No public exploit code and no CISA KEV listing were observed at time of analysis, and no EPSS score was supplied, so real-world exploitation activity is unconfirmed.
Full takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an authenticated attacker holding high privileges, who can send crafted HTTP requests to the Security component and gain complete control of confidentiality, integrity, and availability. The vulnerability is rated CVSS 7.2, and no public exploit code or active exploitation has been identified at time of analysis; EPSS data is unavailable. The high-privilege requirement limits exposure to already-compromised or insider accounts, but successful exploitation yields total application compromise.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a low-privileged account and sits on the same adjacent network segment as the HFM server take full control of the application. Exploitation is rated AV:A/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact, and Oracle's January 2026 Security Alert (cspusep2026) is the authoritative advisory. No public exploit code has been identified and there is no CISA KEV listing at the time of analysis, so risk is concentrated in environments where untrusted parties can reach the HFM host's network segment.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a high-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity and availability impact across a single security scope. Successful exploitation means takeover of the HFM platform rather than a narrow data leak — the attacker gains the ability to read, alter and disrupt the financial consolidation environment. The vulnerability is remotely reachable and low-complexity once the required privileged position is obtained, though no public exploit code and no CISA KEV entry have been reported at time of analysis; the fixed release is delivered through Oracle's Critical Security Patch Update channel.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated attacker positioned on the same adjacent network segment read and tamper with critical financial consolidation data. The vendor rates it CVSS 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-execute but high-impact attack that can also affect connected EPM products through a scope change. No public exploit code or CISA KEV listing was identified at time of analysis, and no CWE or EPSS data accompanies the advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-trigger but unauthenticated network flaw in its Security component that lets an attacker reaching the TLS-exposed service read, create, modify or delete any financial consolidation data the application can access. CVSS 3.1 scores it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting complete confidentiality and integrity loss with no availability impact, and Oracle explicitly characterises exploitation as difficult. No public exploit code, EPSS score, or CISA KEV entry was provided at time of analysis, so this should be treated as a patch-now integrity risk to financial reporting data rather than an actively exploited incident.
Authentication bypass in Oracle Hyperion Financial Management 11.2.26.0.000 allows an unauthenticated attacker positioned on the adjacent network segment to read, create, modify, or delete critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. No public exploit code, EPSS score, or CISA KEV listing was included in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an authenticated attacker who already holds a low-privileged logon on the host running the application seize full control of the HFM instance, with high confidentiality, integrity and availability impact. Oracle rates the attack as difficult (AC:H) and the vector is strictly local (AV:L) with no user interaction, so the exposure is limited to operators of the affected server rather than the network at large. No public exploit code has been identified at time of analysis, and the only supplied reference is Oracle's Critical Security Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a high-privileged account reach the application over HTTP and fully take over the HFM instance, with high impact to confidentiality, integrity, and availability. Exploitation is rated as easy (AC:L, no user interaction) once the privileged foothold exists, so the practical barrier is obtaining or abusing an administrative credential rather than defeating any exploit mitigation. There is no public exploit code or CISA KEV entry at time of analysis, and no EPSS score was supplied, so the real-world risk is driven by internal admin-account hygiene and network exposure of the HFM web tier.
Authenticated low-privileged attackers who can reach the SQL-facing surface of Oracle Hyperion Financial Management 11.2.26.0.000 can achieve complete takeover of the application. Oracle's advisory rates this 8.8 with full confidentiality, integrity, and availability impact, and the flaw is described as easily exploitable with no user interaction required. At the time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS score in the supplied intelligence, so this should be treated as a high-severity, patch-now issue rather than a known active campaign.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged, network-connected user take full control of the application, with high impact to confidentiality, integrity and availability. Exploitation is rated difficult (AC:H) because it depends on a narrow timing or state precondition, but once met it requires only an authenticated low-privilege session over HTTP and no user interaction. No public exploit code or CISA KEV entry was provided at time of analysis, and no CWE classification or EPSS score accompanied the vendor disclosure.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable security flaw in its Security component that lets a low-privileged, authenticated attacker reach the application over HTTP and obtain unauthorized access to critical financial consolidation data, with a secondary ability to cause a partial denial of service. The vendor rates it 7.1 with network vector, low complexity, and no user interaction, meaning an attacker only needs a valid low-privilege account rather than administrative rights. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so current exploitation status is unconfirmed.
Hyperion Financial Management 11.2.26.0.000 can be compromised by an unauthenticated attacker who can reach the product's SSH service, resulting in unauthorized reading, creation, deletion, or modification of the financial data the application manages. Oracle scores this CVSS 7.4 (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N), pairing high confidentiality and integrity impact with a stated difficulty of exploitation. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so exposure should be judged from network reachability of SSH rather than from confirmed in-the-wild activity.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker with HTTP access to the application read, create, delete, or alter critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning exploitation requires a valid but low-privileged account and no user interaction, but yields both high confidentiality and high integrity impact. No public exploit code or CISA KEV listing is identified in the supplied intelligence, so this is currently a patch-priority issue rather than a confirmed active campaign, though the affected data set is exactly the kind of high-value financial record attackers target.
High-privileged users with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to read critical financial data and partially disrupt service availability. Oracle rates the issue CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C), and the scope-change metric indicates the compromise can extend to connected products beyond HFM itself. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation activity remains unconfirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a flaw in its Security component that allows an unauthenticated attacker positioned on the same network segment as the HFM server to read and tamper with the application's critical data. Successful exploitation yields high confidentiality and integrity impact — financial consolidation records, metadata and user data can be viewed, created, deleted or modified — while availability is unaffected. Oracle has rated it 8.1 and issued a fix in the cspusep2026 Critical Patch Update; no public exploit code or CISA KEV listing is present in the available intelligence, so active exploitation is not confirmed.
Unauthenticated attackers with network access to the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to fully compromise the application, with high impact to confidentiality, integrity and availability (CVSS 8.1). Oracle rates the flaw as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control rather than on a trivially repeatable request. No CISA KEV listing, EPSS score or public exploit code was provided in the source data, so active exploitation and weaponization are not confirmed.
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP and gain unauthorized read, creation, deletion, or modification access to critical application data, with the potential to affect connected downstream products because of the scope-change characteristic of the flaw. Oracle rates it as easily exploitable and assigns a CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting network reachability, low complexity, no authentication, no user interaction, and high confidentiality and integrity impact while availability is unaffected. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was supplied, but the combination of unauthenticated access and maximum base score makes this a priority patching item for any internet- or partner-reachable HFM 11.2.26.0.000 deployment.
Unauthenticated remote attackers can compromise Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP, gaining the ability to create, delete, or modify critical financial consolidation data and to read a subset of application data. Oracle rates the flaw 8.2 with high integrity impact and low confidentiality impact, and classifies it as easily exploitable (network vector, no privileges, no user interaction). No public exploit code or CISA KEV entry is present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis.
Unauthenticated HTTP requests against Oracle Hyperion Financial Management 11.2.26.0.000 can bypass the application's authentication controls, exposing critical financial consolidation data and permitting limited insert, update or delete operations. Oracle scores it 8.2 on a network, no-privileges, no-interaction vector, so any instance whose web tier is reachable from an untrusted network is exposed. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an authenticated, low-privileged attacker who reaches the application over the network via HTTP and exploits a flaw in its Security component. Oracle's advisory rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), describing it as easily exploitable with complete loss of confidentiality, integrity and availability. No EPSS score, CISA KEV entry, or public proof-of-concept was supplied in the available intelligence, so active exploitation is unconfirmed; the only vendor reference is the Oracle Critical Security Patch Update advisory.
A low-privileged attacker with network access over HTTP can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000, achieving complete loss of confidentiality, integrity, and availability of the application (CVSS 3.1 base 8.8). The defect resides in the product's Security component and requires only a valid low-privileged account, with no user interaction, making it straightforward to automate once an attacker has a foothold. There is no public exploit identified at time of analysis and no CISA KEV listing, but Oracle's Critical Security Patch Update advisory is the authoritative source for the fix.
A security-control flaw in Oracle Hyperion Financial Management 11.2.26.0.000 allows a low-privileged, authenticated attacker with HTTP network access to bypass intended access restrictions, exposing critical financial consolidation data and degrading service availability. Successful exploitation yields high confidentiality impact (complete access to data the account should not reach) plus a partial denial of service, giving a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). Oracle has addressed the issue in its Critical Security Patch Update; no public exploit code or CISA KEV entry was present in the intelligence provided, so exploitation status is 'no public exploit identified at time of analysis'.
Low-privileged authenticated attackers with HTTP network access can exploit the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 to fully take over the application, with high impact to confidentiality, integrity and availability. Oracle scores the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is low-complexity once a valid low-privilege account exists, and a fix is published through Oracle's Critical Patch Update process. No public exploit code or CISA KEV entry has been identified at the time of analysis, and no EPSS score was supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 is exposed through its Security component to unauthenticated, network-reachable attackers over HTTP, who can create, delete, or modify critical financial consolidation data and repeatedly crash or hang the application (CVSS 3.1 base score 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Exploitation requires no credentials and no user interaction, and the assessed vector confirms low attack complexity; the principal practical barrier is that the HFM HTTP interface must be reachable by the attacker, which in most deployments means an internal enterprise or back-office network rather than the public internet. There is no confidentiality impact - the flaw affects data integrity and availability only. At the time of analysis, no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); exploitation status and patch availability should be re-checked against the Oracle Security Alert referenced below.
Unauthenticated remote attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can send crafted HTTP requests through the Security component to trigger a hang or repeatable crash, producing a complete denial of service of the application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is rated 'easily exploitable' by Oracle. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so current risk is driven by exposure of the application rather than observed exploitation.
Unauthenticated attackers with HTTP network access can bypass the security controls of Oracle Hyperion Financial Management 11.2.26.0.000, gaining unauthorized read access to critical financial consolidation data. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is tagged as an authentication bypass in the product's Security component. No KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so the current exploitation status is unknown and the issue should be treated as a patch-now information-disclosure risk for internet- or partner-reachable HFM deployments.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that an attacker positioned on the same adjacent network segment as the HFM host can exploit without authentication or user interaction to hang or repeatedly crash the application (complete denial of service) and to make limited unauthorized inserts, updates or deletes against data the application can reach. The vendor rates it 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), so confidentiality is untouched while availability is fully lost and integrity is partially degraded. No public exploit code has been identified at time of analysis and no EPSS or KEV signal was supplied, but the low attack complexity and zero authentication requirement make this a segment-level risk for any organization exposing HFM to shared or flat internal networks.
A security-component flaw in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged account and can log on to the infrastructure hosting the application bypass or subvert its security controls. Successful exploitation yields high confidentiality and integrity impact on Hyperion Financial Management data and, because the CVSS vector carries a scope change (S:C), can also significantly affect interconnected Oracle EPM products. Oracle rates this 8.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N); no CISA KEV entry, EPSS score, or public exploit code was present in the supplied intelligence, so the flaw is not confirmed as actively exploited at time of analysis.
Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 server can exploit a flaw in the product's Security component to modify or destroy critical financial data and to crash the application repeatedly. Oracle rates this at CVSS 3.1 base 8.1 with integrity and availability impact but no confidentiality impact, and the restricted AV:A vector means the attacker must already sit on the physical communication segment attached to the host rather than reaching it over the internet. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is concentrated in environments where flat layer-2 networks expose EPM servers to semi-trusted users or adjacent compromised hosts.
Unauthenticated, remote attackers with HTTP reachability to Hyperion Financial Management 11.2.26.0.000 can bypass authentication in the product's Security component and then create, delete or modify critical financial data and read all HFM-accessible data, matching Oracle's own 'easily exploitable' rating and a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, no availability impact). The CWE-287 classification frames this as a pre-authentication control failure rather than a memory-safety bug, so a crafted request that reaches the vulnerable endpoint is treated as legitimate; CISA's SSVC framework records Exploitation: none, Automatable: yes and Technical Impact: total. There is no CISA KEV entry and no public exploit code identified at time of analysis (ENISA EUVD-2026-79872 tracks the same single affected version), but this is a genuine high-priority pre-authentication flaw in a data-critical financial application whose main practical constraint is network exposure of the HFM web tier.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker who can log on to the host running the application take full control of the product. Successful exploitation results in complete loss of confidentiality, integrity and availability of the financial consolidation environment (CVSS 3.1 base 7.8, AV:L/PR:L). No public exploit code or CISA KEV listing was identified in the supplied intelligence, and the only reference is Oracle's Critical Security Patch Update advisory, so patch status should be confirmed against that document.
Unauthenticated remote denial of service in Oracle Hyperion Financial Management 11.2.26.0.000 (Security component) lets any attacker who can reach the service over TCP cause a hang or repeatable full crash of the application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is fixed through Oracle's Critical Security Patch Update cycle described in the cspusep2026 advisory. There is no public exploit code, no CISA KEV listing, and no EPSS signal in the supplied data, so this should be triaged as a high-severity availability risk for internet- or network-exposed HFM deployments rather than an actively exploited emergency.
Authenticated attackers who already hold high application privileges on Oracle Hyperion Financial Management 11.2.26.0.000 can fully take over the product over the network through its HTTP interface, with the impact extending beyond HFM itself due to a scope change. Oracle scores this 9.1 (CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), so while the technical exploit path is low-complexity and requires no user interaction, the high-privilege prerequisite means this is a post-compromise or malicious-insider escalation path rather than an anonymous remote attack. No public exploit code has been identified at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-exploit but unauthenticated security flaw reachable over HTTP through the product's Security component, allowing an attacker to read and tamper with financial consolidation data. The CVSS 3.1 score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), and Oracle's tag for the issue points to an authentication bypass. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it is a patching priority rather than a confirmed active threat.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a Security-component flaw that lets an unauthenticated remote attacker with network access create, delete, or modify critical financial consolidation data and read the full contents of the application's accessible data set. Exploitation is rated difficult (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N), implying a timing-, state-, or query-construction dependency rather than a one-shot request. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the confidentiality and integrity impact is total for exposed deployments, so the Oracle Critical Security Patch Update referenced by the vendor should be treated as mandatory.
Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000, the financial consolidation and reporting module of the Oracle Hyperion EPM suite. Because the flaw is reachable over HTTP with no credentials or user interaction, an attacker with network access to the application can read consolidation data, metadata and reports that should be restricted, resulting in a full confidentiality loss (CVSS 7.5) with no integrity or availability impact. The issue was published in an Oracle Critical Patch Update advisory; no public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exploitation is assessed as targeted rather than widespread until telemetry proves otherwise.
Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 deployment can defeat security controls in the product's Security component, obtaining full read and write access to financial consolidation data while also partially degrading service availability. The flaw rates CVSS 8.3 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:L), meaning no credentials or user interaction are needed, but the attack surface is limited to the adjacent network path rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes sensitive application data and can be partially disrupted by low-privileged attackers who reach the product over HTTP, due to a flaw in the Security component. Per the Oracle-sourced CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), exploitation yields high confidentiality impact plus a partial denial of service, but no integrity impact and no scope change. No public exploit code, EPSS score, or CISA KEV entry was provided with this record, so active exploitation is unconfirmed and the practical threat depends on whether the HTTP/security interface is exposed to untrusted networks.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an improper authorization flaw in its Security component that lets a low-privileged, network-positioned attacker with a valid account reach and read critical financial consolidation data, and also modify a limited subset of that data. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N), reflecting a remotely reachable, low-complexity path that requires only basic authenticated access. There is no KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied with the source data, so this should be treated as a serious but not yet demonstrably exploited enterprise application flaw.
Full compromise of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through a SQL-based attack against the product's Security component, with High confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). The critical qualifier is privilege: exploitation requires an attacker who already holds a high-privileged account and network reachability to the affected component, so this is primarily an insider, credential-compromise, or laterally-moving-attacker risk rather than an unauthenticated perimeter threat. No EPSS score, CISA KEV listing, or public exploit code was supplied; the only reference is Oracle's Critical Patch Update advisory, and no exact patched build version is stated in the available data.
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management 11.2.26.0.000 web interface over HTTP can bypass the product's security controls and gain unauthorized read and write access to financial consolidation data, although Oracle rates the attack as difficult to execute (AC:H). The vendor addressed the flaw in its Critical Security Patch Update advisory, and no public exploit code or CISA KEV entry was identified at time of analysis. EPSS data was not supplied in the available intelligence, so real-world exploitation likelihood cannot be quantified from these sources.
Unauthenticated HTTP requests against Oracle Hyperion Financial Management 11.2.26.0.000 can bypass the product's Security component and expose every record the application can reach, including sensitive financial consolidation data. Oracle scores it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning any attacker who can reach the HFM web tier needs no credentials and no user interaction — only confidentiality is impacted, with no data modification or denial of service. The supplied intelligence contains no CISA KEV listing, no EPSS score, and no public exploit code, so the current status is 'no public exploit identified at time of analysis'; real priority therefore hinges on whether the instance is network-reachable beyond a trusted segment.
Authenticated low-privileged attackers with HTTP access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in the product's Security component, gaining complete control of confidentiality, integrity and availability (CVSS 8.8). The issue is easily exploitable once a valid account exists — low complexity, no user interaction — and results in takeover of the HFM application rather than a limited data leak. No EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed and no public exploit code was identified at time of analysis.
A low-privileged attacker who can reach the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can take over the application by exploiting a flaw in its Security component. Although rated CVSS 3.1 7.5, the vulnerability is explicitly difficult to exploit (AC:H) and requires valid low-privileged credentials (PR:L), but successful exploitation yields full confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation appears in the available intelligence, and no EPSS or CISA KEV data was supplied.
A flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who can reach the service over the network take full control of the application via SQL-based manipulation. Oracle's Critical Security Patch Update rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability with no user interaction. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the immediate driver is the fully-compromised-outcome severity for any internet- or partner-exposed HFM deployment, not observed attacks.
Authenticated low-privileged attackers with HTTP access to Oracle Hyperion Financial Management 11.2.26.0.000 can fully compromise the application through a flaw in its Security component, gaining complete control over confidentiality, integrity and availability of the platform. Oracle rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and describes it as 'easily exploitable', meaning a valid low-privilege account is the main barrier rather than technical complexity. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so exploitation status is 'no public exploit identified at time of analysis' — but the low attack complexity and the sensitivity of financial consolidation data make this a priority for internet- or intranet-exposed HFM deployments.
Unauthenticated attackers with network reachability to Oracle Hyperion Financial Management 11.2.26.0.000 can reach an exposed HTTP interface and tamper with or delete critical financial consolidation data, while also degrading service availability. Oracle rates the flaw 8.2 with full integrity impact and partial availability impact, but no privilege or interaction requirements. No public exploit code or CISA KEV listing was provided in the source data, and the input includes no EPSS score, so real-world exploitation volume is unquantified.
Unauthenticated remote attackers can render Oracle Hyperion Financial Management 11.2.26.0.000 unavailable by sending crafted HTTP requests that hang or repeatedly crash the application (complete denial of service). The flaw sits in the product's Security component and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials, no user interaction, and no special complexity are required once the HTTP interface is reachable. At the time of analysis, no public exploit code has been identified and no EPSS, KEV, or POC data was supplied, so active exploitation is unconfirmed — the practical risk is driven mainly by whether the HFM web endpoint is exposed beyond a trusted network.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security flaw in its Security component that lets an unauthenticated attacker reachable over HTTP bypass access controls and gain both read and write access to the application's critical financial data. Oracle rates it 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), with the high attack-complexity metric indicating that some non-trivial precondition must be met before the bypass succeeds. There is no public exploit code or CISA KEV listing in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP, gaining access to and limited modification of financial consolidation data managed by the application. Oracle rates it 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), with high confidentiality impact and low integrity impact and no availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed as active, but the flaw is trivial to attempt from any network position with HTTP reachability and is addressed only through the Oracle Critical Patch Update.
Oracle Hyperion Financial Management 11.2.26.0.000 can be compromised by an unauthenticated attacker who reaches its HTTP interface, allowing a full read of critical financial-consolidation data plus partial modification of that data. Oracle's advisory rates this 8.2 with a fully remote, no-privilege, no-interaction vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), which is unusual and places it among the more severe entries in the 2026 Hyperion security alert. There is no public exploit code and no CISA KEV listing in the supplied data, so the immediate risk is exposure-driven rather than evidence of active exploitation.
Oracle Hyperion Financial Management 11.2.26.0.000 (component: Security) can be compromised by an unauthenticated attacker who reaches the product over the network via TLS, resulting in unauthorized read, creation, modification and deletion of critical consolidation data. The vendor rates this 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), with the high attack-complexity metric reflecting a flaw that is difficult to trigger reliably rather than a trivial path. Security tagging points to an authentication-bypass condition in the Security component; no public exploit code or CISA KEV entry was available at time of analysis, and no EPSS data was supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-control bypass in its Security component that permits unauthenticated attackers with network access over HTTP to reach data they should not be able to see. Successful exploitation yields high confidentiality impact — unauthorized access to critical data or complete access to all Hyperion Financial Management data accessible to the application — while integrity and availability are unaffected. The flaw is rated 7.5 by Oracle and is trivially automatable (AV:N/AC:L/PR:N/UI:N); no public exploit code or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Financial Management 11.2.26.0.000 to gain unauthorized access to critical data. The flaw resides in the Security component, allowing full read access to all application data over HTTP with no user interaction or privileges required. No public exploit code or active exploitation is currently confirmed, but the high confidentiality impact and low attack complexity make it a priority for patching.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable flaw in its Security component that lets an attacker holding a low-privileged account reach the application over HTTP to read critical financial data and degrade availability. Rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), the issue requires only a valid low-privileged login rather than administrative rights, making any ordinary HFM user account a viable starting point. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; EPSS data was not supplied.
A security-component flaw in Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who already holds a valid account and network access to the HTTP interface read critical financial consolidation data and partially degrade availability of the application. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), reflecting high confidentiality and low availability impact with no integrity exposure. There is no public exploit code or CISA KEV entry identified at time of analysis, so exploitation is currently assessed as targeted rather than opportunistic.
Full takeover of Oracle Hyperion Financial Management is achievable by a low-privileged, authenticated attacker who can reach the product's Security component over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity and availability (C:H/I:H/A:H). Only version 11.2.26.0.000 is listed as affected, and the CVSS 3.1 base score of 7.5 is capped by two meaningful limiters rather than by reduced impact: AC:H, meaning the vendor itself rates the attack 'difficult' and dependent on timing, configuration or state conditions outside the attacker's full control, and PR:L, meaning a valid low-privileged account is a hard prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied, so the practical near-term risk is driven by the severity of the post-exploitation outcome rather than by observed threat activity.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privileged (administrative or operator-level) account on the target and who can reach it over Oracle Net rather than standard HTTP. The flaw sits in the product's Security component, requires no user interaction, and carries low attack complexity once privileged access and Oracle Net connectivity exist, with a scope change (S:C) indicating that a successful compromise can extend beyond HFM to other products in the deployment. The high-privilege prerequisite (PR:H) rules out anonymous internet attackers, so realistic exploitation depends on insider access, stolen credentials, or a prior compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied.
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper authentication flaw in the product's Security component, allowing an attacker who can reach the HTTP service to fully compromise confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, but CISA's SSVC decision framework classifies it as automatable with total technical impact, meaning a working bypass would be trivial to replicate at scale once published. Exposure is limited to deployments running the specific affected release whose HTTP interface is reachable from an untrusted network; no non-default toggle or feature state is named in the advisory as a prerequisite, so default installations on 11.2.26.0.000 must be treated as exposed.
Unauthenticated attackers positioned on a network segment adjacent to an Oracle Hyperion Financial Management server can fully compromise the application, resulting in complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8). Only version 11.2.26.0.000 is identified as affected, and Oracle's September 2026 Critical Patch Update advisory is the sole reference. No public exploit code, EPSS score, or CISA KEV listing is present in the available data, so active exploitation is not confirmed.
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 server can exploit a flaw in the Security component to achieve full takeover of the application, with potential impact on other connected products due to scope change. The vulnerability requires adjacency (AV:A) rather than internet reachability, and no authentication or user interaction is needed, making it high risk for poorly segmented environments. No public exploit code has been identified at time of analysis, and CISA KEV does not list active exploitation.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an authenticated low-privileged attacker reach the application over HTTP and escalate to full takeover of the HFM instance, with high impact to confidentiality, integrity and availability. The vulnerability is trivially automatable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning any valid low-rights account becomes a stepping stone to administrative control of the financial consolidation platform. Exploitation status at time of analysis: no public exploit identified and no CISA KEV listing; no EPSS score or CWE classification was supplied with the source data.
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentication in the product's Security component and take full control of the application, yielding complete confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation requires no credentials and no user interaction, only reachability to the affected HFM instance's SQL-facing interface, which the SSVC assessment rates as fully automatable with total technical impact. There is currently no public exploit identified at time of analysis and no confirmed active exploitation, but the low attack complexity and unauthenticated vector make this a top-priority patching target wherever HFM is exposed beyond tightly segmented internal networks.
A locally exploitable flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a high-privileged logon on the host running the application take full control of the product, with potential follow-on impact to other connected Oracle components (scope change). Exploitation additionally requires a user other than the attacker to perform some interaction, making this a privileged-operator-plus-social-engineering attack rather than a remote unauthenticated one, although successful exploitation yields complete confidentiality, integrity and availability loss on the HFM instance. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied with the intelligence feed.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged logon on the host running the application take over the product, with a scope change indicating the compromise can extend to interconnected systems. Successful exploitation yields full confidentiality, integrity and availability impact — this is a takeover-class flaw, not merely an information leak. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was provided with the record.
Low-privileged attackers with HTTP network access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in its Security component, achieving high impact to confidentiality, integrity, and availability (CVSS 8.8). The vulnerability is easily exploitable with no user interaction, and successful exploitation can result in complete takeover of the HFM application and the financial consolidation data it manages. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV, though the low attack complexity means weaponization risk is meaningful; Oracle addressed it in its April 2026 Critical Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 can be taken over by a low-privileged attacker who can reach the application's HTTP interface, because the Security component does not properly restrict what an authenticated but unprivileged session can do. Successful exploitation yields full compromise of confidentiality, integrity and availability of the HFM application, meaning an attacker could read, alter or destroy financial consolidation data and gain administrative control of the deployment. The flaw is rated 8.8 on CVSS 3.1; no public exploit code or CISA KEV listing was present in the source data at time of analysis, so this is currently a patch-now, monitor-for-exploitation issue rather than a confirmed actively exploited one.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-component flaw that lets a low-privileged, network-connected user take full control of the application over HTTP. Per the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), exploitation requires only a valid low-privilege account and no user interaction, but delivers complete compromise of confidentiality, integrity and availability. There is no public exploit code or CISA KEV entry in the supplied intelligence at time of analysis; the only consolidated signal is Oracle's own security alert, and separate risk scores (EPSS) were not provided.
Improper access control in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds high privileges and can reach the application over the network submit crafted SQL to read, create, delete, or modify critical financial consolidation data. The CVSS 3.1 base score is 8.7 with a scope change, meaning a successful attack can extend beyond the HFM component into interconnected products that share credentials or database access. Oracle shipped a fix in its September 2026 Critical Security Patch Update, and no public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged user with network access over HTTP read critical financial data and make limited unauthorized modifications, with a scope change that can expose other connected Oracle products. Oracle rates it CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), meaning exploitation requires only a low-privileged authenticated session — not administrative rights — and no user interaction. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied with the available data, so real-world exploitation likelihood is unquantified at this time.
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management Security component over TCP can bypass authentication and gain unauthorized access to, and modification of, all data managed by the affected deployment. The flaw is rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and affects only version 11.2.26.0.000; there is no availability impact, so the exposure is full compromise of confidentiality and integrity rather than denial of service. At time of analysis there is no public exploit identified, though CISA's SSVC assessment marks the flaw as fully automatable with total technical impact, so a patch should be prioritized ahead of any observed exploitation.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a pre-authentication defect in its Security component that allows remote, unauthenticated attackers with TCP network access to bypass authentication and gain full read/write access to all HFM data. The flaw is rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials, no user interaction, and no non-default configuration are required - only network reachability to the HFM tier, which in most enterprises sits behind the perimeter rather than internet-facing. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as 'none,' though the flaw is rated automatable with total technical impact, so an exploit, once developed, would likely be reliable and repeatable across exposed instances; availability is unaffected (A:N), so the threat is data theft and tampering rather than denial of service.
Unauthenticated remote attackers can bypass authentication in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000, obtaining complete read access to the financial consolidation and reporting data the application can reach, plus limited unauthorized modification. Oracle's own advisory rates it 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), placing it in the most dangerous class of EPM flaws because no credentials or user interaction are needed. The supplied intelligence contains no EPSS score, no CISA KEV entry and no public exploit code, so active exploitation is not confirmed.
Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Financial Management 11.2.26.0.000 via TCP, gaining full read and write access to critical data (CVSS 9.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, CWE-287). The flaw resides in the Security component and requires only network reachability of the affected service, with no user interaction or privileges needed; CISA SSVC rates exploitation as 'none' and automatable. No public exploit code was identified at time of analysis, and while HFM is typically deployed internally behind the corporate perimeter, the high base score and total technical impact warrant urgent patching for exposed instances.
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a valid low-privilege application account and can reach the product's HTTP interface, because the Security component does not adequately enforce privilege boundaries (assessed CVSS 3.1 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). No user interaction is required, and the scope change (S:C) means a successful compromise can significantly impact additional integrated products that trust HFM, widening the blast radius well beyond the vulnerable host itself. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the risk is driven by the trivial exploitation path available to anyone who can obtain a low-privilege login rather than by observed active exploitation.
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management 11.2.26.0.000 Security component over HTTPS can bypass its authentication controls and gain read and write access to critical financial data, with the exploit's impact crossing into other integrated Oracle EPM products (scope change). Oracle rates this CVSS 3.1 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), explicitly noting it is difficult to exploit; no public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided. The practical concern is data integrity and confidentiality of consolidation records rather than remote code execution, since availability impact is rated None.
Unauthenticated remote attackers with HTTP access can exploit improper authentication in Oracle Hyperion Financial Management 11.2.26.0.000 to read, create, delete, or modify all data accessible through the application. The Security-component flaw carries CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is fully automatable with total technical impact, though no public exploit or active exploitation is identified at time of analysis; exposure is chiefly constrained by whether the HFM web tier is reachable from attacker networks.
Full compromise of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, targeting the Security component to gain complete control over confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 reflects the combination of network accessibility, low attack complexity, and no user interaction required beyond a valid low-privilege account. No public exploit code or CISA KEV listing has been identified at time of analysis, though the severity of the stated outcome - full system takeover - warrants immediate patch application.
Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker exploiting a flaw in the Security component, with confirmed scope change enabling impact on additional adjacent products. The CVSS vector (AV:L/AC:H/PR:H) reflects a difficult-to-exploit, infrastructure-local attack requiring significant access prerequisites, yet successful exploitation yields complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is best understood as an insider or post-compromise escalation threat rather than an opportunistic remote attack.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a Security component flaw - tagged as an authentication bypass - that enables low-privileged authenticated attackers to gain complete read access to all data within the application and limited write access, with a confirmed scope change extending impact to additional Oracle Hyperion suite products. Exploitation requires human interaction from a victim but carries low attack complexity and is reachable over HTTP without elevated privileges. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is possible via a network-accessible HTTP attack against the Security component. The CVSS vector confirms no authentication, no user interaction, and no special conditions are required, placing this squarely in the high-severity, easily exploitable category. Successful exploitation yields complete read access to all data accessible by the application and a partial denial of service, making this a critical risk for financial institutions running the affected build. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by a network-accessible, high-privileged attacker exploiting a flaw in the Security component via HTTP. The vulnerability carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, amounting to effective product compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and complete CIA triad impact warrant prompt remediation attention.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker targeting the Security component over HTTP, resulting in complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 7.5 (High) reflects this total impact, though high attack complexity (AC:H) constrains opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS data was supplied in the source intelligence.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker via TCP, with no user interaction required. The vulnerability resides in the Security component and results in complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible lateral-movement risk in enterprise financial environments.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 allows unauthenticated, network-adjacent attackers to fully read and manipulate sensitive financial consolidation data without any credentials. The affected component is HFM's Security subsystem, and exploitation requires only adjacency to the physical or logical network segment hosting the application - no user interaction or privileges needed. No public exploit code and no CISA KEV listing exist at time of analysis, though the low attack complexity makes this straightforward to exploit for any attacker achieving network adjacency.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged network attackers to bypass security controls and gain complete access to sensitive financial data via HTTP. Tagged as an Authentication Bypass in EUVD-2026-61889, the flaw carries a CVSS scope change indicator meaning successful exploitation can extend confidentiality impacts to additional Oracle Hyperion products sharing the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's own designation of this as 'easily exploitable' and the low attack complexity are meaningful risk signals for organizations running this financial consolidation platform.
Full system takeover is achievable in Oracle Hyperion Financial Management 11.2.25.0.000 through a flaw in its Security component, exploitable over HTTP by any low-privileged attacker with network access and no required user interaction. The CVSS 3.1 score of 8.8 reflects complete high-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a low-privileged, authenticated attacker with HTTP network access to read critical financial data and to update, insert, or delete some of the data the application exposes, with the impact spilling over into other products (scope change). Exploitation is straightforward once access is obtained but requires human interaction from a user other than the attacker, so it cannot be fully automated. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); EPSS data was not supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated, network-positioned attacker tamper with or destroy critical financial consolidation data and partially degrade service availability — but only if a victim user is persuaded to interact with the attacker's crafted request (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 7.1). Integrity is the dominant impact (I:H), with only partial denial of service (A:L) and no confidentiality exposure (C:N). There is no public exploit identified at time of analysis and no KEV listing; no EPSS score was supplied in the source data, so the exploitation-probability signal is absent rather than low.
Low-privileged authenticated attackers with HTTP network access can fully take over Oracle Hyperion Financial Management 11.2.26.0.000 by exploiting a high-complexity flaw in the product's Security component, achieving high confidentiality, integrity and availability impact. Oracle rates the issue CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting that exploitation is difficult but complete compromise results. No public exploit code and no CISA KEV listing were observed at time of analysis, and no EPSS score was supplied, so real-world exploitation activity is unconfirmed.
Full takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an authenticated attacker holding high privileges, who can send crafted HTTP requests to the Security component and gain complete control of confidentiality, integrity, and availability. The vulnerability is rated CVSS 7.2, and no public exploit code or active exploitation has been identified at time of analysis; EPSS data is unavailable. The high-privilege requirement limits exposure to already-compromised or insider accounts, but successful exploitation yields total application compromise.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a low-privileged account and sits on the same adjacent network segment as the HFM server take full control of the application. Exploitation is rated AV:A/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact, and Oracle's January 2026 Security Alert (cspusep2026) is the authoritative advisory. No public exploit code has been identified and there is no CISA KEV listing at the time of analysis, so risk is concentrated in environments where untrusted parties can reach the HFM host's network segment.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a high-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity and availability impact across a single security scope. Successful exploitation means takeover of the HFM platform rather than a narrow data leak — the attacker gains the ability to read, alter and disrupt the financial consolidation environment. The vulnerability is remotely reachable and low-complexity once the required privileged position is obtained, though no public exploit code and no CISA KEV entry have been reported at time of analysis; the fixed release is delivered through Oracle's Critical Security Patch Update channel.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated attacker positioned on the same adjacent network segment read and tamper with critical financial consolidation data. The vendor rates it CVSS 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-execute but high-impact attack that can also affect connected EPM products through a scope change. No public exploit code or CISA KEV listing was identified at time of analysis, and no CWE or EPSS data accompanies the advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-trigger but unauthenticated network flaw in its Security component that lets an attacker reaching the TLS-exposed service read, create, modify or delete any financial consolidation data the application can access. CVSS 3.1 scores it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting complete confidentiality and integrity loss with no availability impact, and Oracle explicitly characterises exploitation as difficult. No public exploit code, EPSS score, or CISA KEV entry was provided at time of analysis, so this should be treated as a patch-now integrity risk to financial reporting data rather than an actively exploited incident.
Authentication bypass in Oracle Hyperion Financial Management 11.2.26.0.000 allows an unauthenticated attacker positioned on the adjacent network segment to read, create, modify, or delete critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. No public exploit code, EPSS score, or CISA KEV listing was included in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an authenticated attacker who already holds a low-privileged logon on the host running the application seize full control of the HFM instance, with high confidentiality, integrity and availability impact. Oracle rates the attack as difficult (AC:H) and the vector is strictly local (AV:L) with no user interaction, so the exposure is limited to operators of the affected server rather than the network at large. No public exploit code has been identified at time of analysis, and the only supplied reference is Oracle's Critical Security Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a high-privileged account reach the application over HTTP and fully take over the HFM instance, with high impact to confidentiality, integrity, and availability. Exploitation is rated as easy (AC:L, no user interaction) once the privileged foothold exists, so the practical barrier is obtaining or abusing an administrative credential rather than defeating any exploit mitigation. There is no public exploit code or CISA KEV entry at time of analysis, and no EPSS score was supplied, so the real-world risk is driven by internal admin-account hygiene and network exposure of the HFM web tier.
Authenticated low-privileged attackers who can reach the SQL-facing surface of Oracle Hyperion Financial Management 11.2.26.0.000 can achieve complete takeover of the application. Oracle's advisory rates this 8.8 with full confidentiality, integrity, and availability impact, and the flaw is described as easily exploitable with no user interaction required. At the time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS score in the supplied intelligence, so this should be treated as a high-severity, patch-now issue rather than a known active campaign.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged, network-connected user take full control of the application, with high impact to confidentiality, integrity and availability. Exploitation is rated difficult (AC:H) because it depends on a narrow timing or state precondition, but once met it requires only an authenticated low-privilege session over HTTP and no user interaction. No public exploit code or CISA KEV entry was provided at time of analysis, and no CWE classification or EPSS score accompanied the vendor disclosure.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable security flaw in its Security component that lets a low-privileged, authenticated attacker reach the application over HTTP and obtain unauthorized access to critical financial consolidation data, with a secondary ability to cause a partial denial of service. The vendor rates it 7.1 with network vector, low complexity, and no user interaction, meaning an attacker only needs a valid low-privilege account rather than administrative rights. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so current exploitation status is unconfirmed.
Hyperion Financial Management 11.2.26.0.000 can be compromised by an unauthenticated attacker who can reach the product's SSH service, resulting in unauthorized reading, creation, deletion, or modification of the financial data the application manages. Oracle scores this CVSS 7.4 (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N), pairing high confidentiality and integrity impact with a stated difficulty of exploitation. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so exposure should be judged from network reachability of SSH rather than from confirmed in-the-wild activity.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker with HTTP access to the application read, create, delete, or alter critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning exploitation requires a valid but low-privileged account and no user interaction, but yields both high confidentiality and high integrity impact. No public exploit code or CISA KEV listing is identified in the supplied intelligence, so this is currently a patch-priority issue rather than a confirmed active campaign, though the affected data set is exactly the kind of high-value financial record attackers target.
High-privileged users with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to read critical financial data and partially disrupt service availability. Oracle rates the issue CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C), and the scope-change metric indicates the compromise can extend to connected products beyond HFM itself. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation activity remains unconfirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a flaw in its Security component that allows an unauthenticated attacker positioned on the same network segment as the HFM server to read and tamper with the application's critical data. Successful exploitation yields high confidentiality and integrity impact — financial consolidation records, metadata and user data can be viewed, created, deleted or modified — while availability is unaffected. Oracle has rated it 8.1 and issued a fix in the cspusep2026 Critical Patch Update; no public exploit code or CISA KEV listing is present in the available intelligence, so active exploitation is not confirmed.
Unauthenticated attackers with network access to the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to fully compromise the application, with high impact to confidentiality, integrity and availability (CVSS 8.1). Oracle rates the flaw as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control rather than on a trivially repeatable request. No CISA KEV listing, EPSS score or public exploit code was provided in the source data, so active exploitation and weaponization are not confirmed.
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP and gain unauthorized read, creation, deletion, or modification access to critical application data, with the potential to affect connected downstream products because of the scope-change characteristic of the flaw. Oracle rates it as easily exploitable and assigns a CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting network reachability, low complexity, no authentication, no user interaction, and high confidentiality and integrity impact while availability is unaffected. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was supplied, but the combination of unauthenticated access and maximum base score makes this a priority patching item for any internet- or partner-reachable HFM 11.2.26.0.000 deployment.
Unauthenticated remote attackers can compromise Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP, gaining the ability to create, delete, or modify critical financial consolidation data and to read a subset of application data. Oracle rates the flaw 8.2 with high integrity impact and low confidentiality impact, and classifies it as easily exploitable (network vector, no privileges, no user interaction). No public exploit code or CISA KEV entry is present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis.
Unauthenticated HTTP requests against Oracle Hyperion Financial Management 11.2.26.0.000 can bypass the application's authentication controls, exposing critical financial consolidation data and permitting limited insert, update or delete operations. Oracle scores it 8.2 on a network, no-privileges, no-interaction vector, so any instance whose web tier is reachable from an untrusted network is exposed. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an authenticated, low-privileged attacker who reaches the application over the network via HTTP and exploits a flaw in its Security component. Oracle's advisory rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), describing it as easily exploitable with complete loss of confidentiality, integrity and availability. No EPSS score, CISA KEV entry, or public proof-of-concept was supplied in the available intelligence, so active exploitation is unconfirmed; the only vendor reference is the Oracle Critical Security Patch Update advisory.
A low-privileged attacker with network access over HTTP can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000, achieving complete loss of confidentiality, integrity, and availability of the application (CVSS 3.1 base 8.8). The defect resides in the product's Security component and requires only a valid low-privileged account, with no user interaction, making it straightforward to automate once an attacker has a foothold. There is no public exploit identified at time of analysis and no CISA KEV listing, but Oracle's Critical Security Patch Update advisory is the authoritative source for the fix.
A security-control flaw in Oracle Hyperion Financial Management 11.2.26.0.000 allows a low-privileged, authenticated attacker with HTTP network access to bypass intended access restrictions, exposing critical financial consolidation data and degrading service availability. Successful exploitation yields high confidentiality impact (complete access to data the account should not reach) plus a partial denial of service, giving a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). Oracle has addressed the issue in its Critical Security Patch Update; no public exploit code or CISA KEV entry was present in the intelligence provided, so exploitation status is 'no public exploit identified at time of analysis'.
Low-privileged authenticated attackers with HTTP network access can exploit the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 to fully take over the application, with high impact to confidentiality, integrity and availability. Oracle scores the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is low-complexity once a valid low-privilege account exists, and a fix is published through Oracle's Critical Patch Update process. No public exploit code or CISA KEV entry has been identified at the time of analysis, and no EPSS score was supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 is exposed through its Security component to unauthenticated, network-reachable attackers over HTTP, who can create, delete, or modify critical financial consolidation data and repeatedly crash or hang the application (CVSS 3.1 base score 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Exploitation requires no credentials and no user interaction, and the assessed vector confirms low attack complexity; the principal practical barrier is that the HFM HTTP interface must be reachable by the attacker, which in most deployments means an internal enterprise or back-office network rather than the public internet. There is no confidentiality impact - the flaw affects data integrity and availability only. At the time of analysis, no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); exploitation status and patch availability should be re-checked against the Oracle Security Alert referenced below.
Unauthenticated remote attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can send crafted HTTP requests through the Security component to trigger a hang or repeatable crash, producing a complete denial of service of the application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is rated 'easily exploitable' by Oracle. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so current risk is driven by exposure of the application rather than observed exploitation.
Unauthenticated attackers with HTTP network access can bypass the security controls of Oracle Hyperion Financial Management 11.2.26.0.000, gaining unauthorized read access to critical financial consolidation data. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is tagged as an authentication bypass in the product's Security component. No KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so the current exploitation status is unknown and the issue should be treated as a patch-now information-disclosure risk for internet- or partner-reachable HFM deployments.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that an attacker positioned on the same adjacent network segment as the HFM host can exploit without authentication or user interaction to hang or repeatedly crash the application (complete denial of service) and to make limited unauthorized inserts, updates or deletes against data the application can reach. The vendor rates it 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), so confidentiality is untouched while availability is fully lost and integrity is partially degraded. No public exploit code has been identified at time of analysis and no EPSS or KEV signal was supplied, but the low attack complexity and zero authentication requirement make this a segment-level risk for any organization exposing HFM to shared or flat internal networks.
A security-component flaw in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged account and can log on to the infrastructure hosting the application bypass or subvert its security controls. Successful exploitation yields high confidentiality and integrity impact on Hyperion Financial Management data and, because the CVSS vector carries a scope change (S:C), can also significantly affect interconnected Oracle EPM products. Oracle rates this 8.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N); no CISA KEV entry, EPSS score, or public exploit code was present in the supplied intelligence, so the flaw is not confirmed as actively exploited at time of analysis.
Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 server can exploit a flaw in the product's Security component to modify or destroy critical financial data and to crash the application repeatedly. Oracle rates this at CVSS 3.1 base 8.1 with integrity and availability impact but no confidentiality impact, and the restricted AV:A vector means the attacker must already sit on the physical communication segment attached to the host rather than reaching it over the internet. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is concentrated in environments where flat layer-2 networks expose EPM servers to semi-trusted users or adjacent compromised hosts.
Unauthenticated, remote attackers with HTTP reachability to Hyperion Financial Management 11.2.26.0.000 can bypass authentication in the product's Security component and then create, delete or modify critical financial data and read all HFM-accessible data, matching Oracle's own 'easily exploitable' rating and a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, no availability impact). The CWE-287 classification frames this as a pre-authentication control failure rather than a memory-safety bug, so a crafted request that reaches the vulnerable endpoint is treated as legitimate; CISA's SSVC framework records Exploitation: none, Automatable: yes and Technical Impact: total. There is no CISA KEV entry and no public exploit code identified at time of analysis (ENISA EUVD-2026-79872 tracks the same single affected version), but this is a genuine high-priority pre-authentication flaw in a data-critical financial application whose main practical constraint is network exposure of the HFM web tier.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker who can log on to the host running the application take full control of the product. Successful exploitation results in complete loss of confidentiality, integrity and availability of the financial consolidation environment (CVSS 3.1 base 7.8, AV:L/PR:L). No public exploit code or CISA KEV listing was identified in the supplied intelligence, and the only reference is Oracle's Critical Security Patch Update advisory, so patch status should be confirmed against that document.
Unauthenticated remote denial of service in Oracle Hyperion Financial Management 11.2.26.0.000 (Security component) lets any attacker who can reach the service over TCP cause a hang or repeatable full crash of the application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is fixed through Oracle's Critical Security Patch Update cycle described in the cspusep2026 advisory. There is no public exploit code, no CISA KEV listing, and no EPSS signal in the supplied data, so this should be triaged as a high-severity availability risk for internet- or network-exposed HFM deployments rather than an actively exploited emergency.
Authenticated attackers who already hold high application privileges on Oracle Hyperion Financial Management 11.2.26.0.000 can fully take over the product over the network through its HTTP interface, with the impact extending beyond HFM itself due to a scope change. Oracle scores this 9.1 (CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), so while the technical exploit path is low-complexity and requires no user interaction, the high-privilege prerequisite means this is a post-compromise or malicious-insider escalation path rather than an anonymous remote attack. No public exploit code has been identified at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-exploit but unauthenticated security flaw reachable over HTTP through the product's Security component, allowing an attacker to read and tamper with financial consolidation data. The CVSS 3.1 score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), and Oracle's tag for the issue points to an authentication bypass. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it is a patching priority rather than a confirmed active threat.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a Security-component flaw that lets an unauthenticated remote attacker with network access create, delete, or modify critical financial consolidation data and read the full contents of the application's accessible data set. Exploitation is rated difficult (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N), implying a timing-, state-, or query-construction dependency rather than a one-shot request. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the confidentiality and integrity impact is total for exposed deployments, so the Oracle Critical Security Patch Update referenced by the vendor should be treated as mandatory.
Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000, the financial consolidation and reporting module of the Oracle Hyperion EPM suite. Because the flaw is reachable over HTTP with no credentials or user interaction, an attacker with network access to the application can read consolidation data, metadata and reports that should be restricted, resulting in a full confidentiality loss (CVSS 7.5) with no integrity or availability impact. The issue was published in an Oracle Critical Patch Update advisory; no public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exploitation is assessed as targeted rather than widespread until telemetry proves otherwise.
Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 deployment can defeat security controls in the product's Security component, obtaining full read and write access to financial consolidation data while also partially degrading service availability. The flaw rates CVSS 8.3 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:L), meaning no credentials or user interaction are needed, but the attack surface is limited to the adjacent network path rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes sensitive application data and can be partially disrupted by low-privileged attackers who reach the product over HTTP, due to a flaw in the Security component. Per the Oracle-sourced CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), exploitation yields high confidentiality impact plus a partial denial of service, but no integrity impact and no scope change. No public exploit code, EPSS score, or CISA KEV entry was provided with this record, so active exploitation is unconfirmed and the practical threat depends on whether the HTTP/security interface is exposed to untrusted networks.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an improper authorization flaw in its Security component that lets a low-privileged, network-positioned attacker with a valid account reach and read critical financial consolidation data, and also modify a limited subset of that data. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N), reflecting a remotely reachable, low-complexity path that requires only basic authenticated access. There is no KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied with the source data, so this should be treated as a serious but not yet demonstrably exploited enterprise application flaw.
Full compromise of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through a SQL-based attack against the product's Security component, with High confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). The critical qualifier is privilege: exploitation requires an attacker who already holds a high-privileged account and network reachability to the affected component, so this is primarily an insider, credential-compromise, or laterally-moving-attacker risk rather than an unauthenticated perimeter threat. No EPSS score, CISA KEV listing, or public exploit code was supplied; the only reference is Oracle's Critical Patch Update advisory, and no exact patched build version is stated in the available data.
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management 11.2.26.0.000 web interface over HTTP can bypass the product's security controls and gain unauthorized read and write access to financial consolidation data, although Oracle rates the attack as difficult to execute (AC:H). The vendor addressed the flaw in its Critical Security Patch Update advisory, and no public exploit code or CISA KEV entry was identified at time of analysis. EPSS data was not supplied in the available intelligence, so real-world exploitation likelihood cannot be quantified from these sources.
Unauthenticated HTTP requests against Oracle Hyperion Financial Management 11.2.26.0.000 can bypass the product's Security component and expose every record the application can reach, including sensitive financial consolidation data. Oracle scores it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning any attacker who can reach the HFM web tier needs no credentials and no user interaction — only confidentiality is impacted, with no data modification or denial of service. The supplied intelligence contains no CISA KEV listing, no EPSS score, and no public exploit code, so the current status is 'no public exploit identified at time of analysis'; real priority therefore hinges on whether the instance is network-reachable beyond a trusted segment.
Authenticated low-privileged attackers with HTTP access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in the product's Security component, gaining complete control of confidentiality, integrity and availability (CVSS 8.8). The issue is easily exploitable once a valid account exists — low complexity, no user interaction — and results in takeover of the HFM application rather than a limited data leak. No EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed and no public exploit code was identified at time of analysis.
A low-privileged attacker who can reach the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can take over the application by exploiting a flaw in its Security component. Although rated CVSS 3.1 7.5, the vulnerability is explicitly difficult to exploit (AC:H) and requires valid low-privileged credentials (PR:L), but successful exploitation yields full confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation appears in the available intelligence, and no EPSS or CISA KEV data was supplied.
A flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who can reach the service over the network take full control of the application via SQL-based manipulation. Oracle's Critical Security Patch Update rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability with no user interaction. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the immediate driver is the fully-compromised-outcome severity for any internet- or partner-exposed HFM deployment, not observed attacks.
Authenticated low-privileged attackers with HTTP access to Oracle Hyperion Financial Management 11.2.26.0.000 can fully compromise the application through a flaw in its Security component, gaining complete control over confidentiality, integrity and availability of the platform. Oracle rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and describes it as 'easily exploitable', meaning a valid low-privilege account is the main barrier rather than technical complexity. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so exploitation status is 'no public exploit identified at time of analysis' — but the low attack complexity and the sensitivity of financial consolidation data make this a priority for internet- or intranet-exposed HFM deployments.
Unauthenticated attackers with network reachability to Oracle Hyperion Financial Management 11.2.26.0.000 can reach an exposed HTTP interface and tamper with or delete critical financial consolidation data, while also degrading service availability. Oracle rates the flaw 8.2 with full integrity impact and partial availability impact, but no privilege or interaction requirements. No public exploit code or CISA KEV listing was provided in the source data, and the input includes no EPSS score, so real-world exploitation volume is unquantified.
Unauthenticated remote attackers can render Oracle Hyperion Financial Management 11.2.26.0.000 unavailable by sending crafted HTTP requests that hang or repeatedly crash the application (complete denial of service). The flaw sits in the product's Security component and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials, no user interaction, and no special complexity are required once the HTTP interface is reachable. At the time of analysis, no public exploit code has been identified and no EPSS, KEV, or POC data was supplied, so active exploitation is unconfirmed — the practical risk is driven mainly by whether the HFM web endpoint is exposed beyond a trusted network.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security flaw in its Security component that lets an unauthenticated attacker reachable over HTTP bypass access controls and gain both read and write access to the application's critical financial data. Oracle rates it 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), with the high attack-complexity metric indicating that some non-trivial precondition must be met before the bypass succeeds. There is no public exploit code or CISA KEV listing in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP, gaining access to and limited modification of financial consolidation data managed by the application. Oracle rates it 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), with high confidentiality impact and low integrity impact and no availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed as active, but the flaw is trivial to attempt from any network position with HTTP reachability and is addressed only through the Oracle Critical Patch Update.
Oracle Hyperion Financial Management 11.2.26.0.000 can be compromised by an unauthenticated attacker who reaches its HTTP interface, allowing a full read of critical financial-consolidation data plus partial modification of that data. Oracle's advisory rates this 8.2 with a fully remote, no-privilege, no-interaction vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), which is unusual and places it among the more severe entries in the 2026 Hyperion security alert. There is no public exploit code and no CISA KEV listing in the supplied data, so the immediate risk is exposure-driven rather than evidence of active exploitation.
Oracle Hyperion Financial Management 11.2.26.0.000 (component: Security) can be compromised by an unauthenticated attacker who reaches the product over the network via TLS, resulting in unauthorized read, creation, modification and deletion of critical consolidation data. The vendor rates this 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), with the high attack-complexity metric reflecting a flaw that is difficult to trigger reliably rather than a trivial path. Security tagging points to an authentication-bypass condition in the Security component; no public exploit code or CISA KEV entry was available at time of analysis, and no EPSS data was supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-control bypass in its Security component that permits unauthenticated attackers with network access over HTTP to reach data they should not be able to see. Successful exploitation yields high confidentiality impact — unauthorized access to critical data or complete access to all Hyperion Financial Management data accessible to the application — while integrity and availability are unaffected. The flaw is rated 7.5 by Oracle and is trivially automatable (AV:N/AC:L/PR:N/UI:N); no public exploit code or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Financial Management 11.2.26.0.000 to gain unauthorized access to critical data. The flaw resides in the Security component, allowing full read access to all application data over HTTP with no user interaction or privileges required. No public exploit code or active exploitation is currently confirmed, but the high confidentiality impact and low attack complexity make it a priority for patching.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable flaw in its Security component that lets an attacker holding a low-privileged account reach the application over HTTP to read critical financial data and degrade availability. Rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), the issue requires only a valid low-privileged login rather than administrative rights, making any ordinary HFM user account a viable starting point. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; EPSS data was not supplied.
A security-component flaw in Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who already holds a valid account and network access to the HTTP interface read critical financial consolidation data and partially degrade availability of the application. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), reflecting high confidentiality and low availability impact with no integrity exposure. There is no public exploit code or CISA KEV entry identified at time of analysis, so exploitation is currently assessed as targeted rather than opportunistic.
Full takeover of Oracle Hyperion Financial Management is achievable by a low-privileged, authenticated attacker who can reach the product's Security component over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity and availability (C:H/I:H/A:H). Only version 11.2.26.0.000 is listed as affected, and the CVSS 3.1 base score of 7.5 is capped by two meaningful limiters rather than by reduced impact: AC:H, meaning the vendor itself rates the attack 'difficult' and dependent on timing, configuration or state conditions outside the attacker's full control, and PR:L, meaning a valid low-privileged account is a hard prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied, so the practical near-term risk is driven by the severity of the post-exploitation outcome rather than by observed threat activity.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privileged (administrative or operator-level) account on the target and who can reach it over Oracle Net rather than standard HTTP. The flaw sits in the product's Security component, requires no user interaction, and carries low attack complexity once privileged access and Oracle Net connectivity exist, with a scope change (S:C) indicating that a successful compromise can extend beyond HFM to other products in the deployment. The high-privilege prerequisite (PR:H) rules out anonymous internet attackers, so realistic exploitation depends on insider access, stolen credentials, or a prior compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied.
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper authentication flaw in the product's Security component, allowing an attacker who can reach the HTTP service to fully compromise confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, but CISA's SSVC decision framework classifies it as automatable with total technical impact, meaning a working bypass would be trivial to replicate at scale once published. Exposure is limited to deployments running the specific affected release whose HTTP interface is reachable from an untrusted network; no non-default toggle or feature state is named in the advisory as a prerequisite, so default installations on 11.2.26.0.000 must be treated as exposed.
Unauthenticated attackers positioned on a network segment adjacent to an Oracle Hyperion Financial Management server can fully compromise the application, resulting in complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8). Only version 11.2.26.0.000 is identified as affected, and Oracle's September 2026 Critical Patch Update advisory is the sole reference. No public exploit code, EPSS score, or CISA KEV listing is present in the available data, so active exploitation is not confirmed.
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 server can exploit a flaw in the Security component to achieve full takeover of the application, with potential impact on other connected products due to scope change. The vulnerability requires adjacency (AV:A) rather than internet reachability, and no authentication or user interaction is needed, making it high risk for poorly segmented environments. No public exploit code has been identified at time of analysis, and CISA KEV does not list active exploitation.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an authenticated low-privileged attacker reach the application over HTTP and escalate to full takeover of the HFM instance, with high impact to confidentiality, integrity and availability. The vulnerability is trivially automatable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning any valid low-rights account becomes a stepping stone to administrative control of the financial consolidation platform. Exploitation status at time of analysis: no public exploit identified and no CISA KEV listing; no EPSS score or CWE classification was supplied with the source data.
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentication in the product's Security component and take full control of the application, yielding complete confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation requires no credentials and no user interaction, only reachability to the affected HFM instance's SQL-facing interface, which the SSVC assessment rates as fully automatable with total technical impact. There is currently no public exploit identified at time of analysis and no confirmed active exploitation, but the low attack complexity and unauthenticated vector make this a top-priority patching target wherever HFM is exposed beyond tightly segmented internal networks.
A locally exploitable flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a high-privileged logon on the host running the application take full control of the product, with potential follow-on impact to other connected Oracle components (scope change). Exploitation additionally requires a user other than the attacker to perform some interaction, making this a privileged-operator-plus-social-engineering attack rather than a remote unauthenticated one, although successful exploitation yields complete confidentiality, integrity and availability loss on the HFM instance. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied with the intelligence feed.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged logon on the host running the application take over the product, with a scope change indicating the compromise can extend to interconnected systems. Successful exploitation yields full confidentiality, integrity and availability impact — this is a takeover-class flaw, not merely an information leak. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was provided with the record.
Low-privileged attackers with HTTP network access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in its Security component, achieving high impact to confidentiality, integrity, and availability (CVSS 8.8). The vulnerability is easily exploitable with no user interaction, and successful exploitation can result in complete takeover of the HFM application and the financial consolidation data it manages. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV, though the low attack complexity means weaponization risk is meaningful; Oracle addressed it in its April 2026 Critical Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 can be taken over by a low-privileged attacker who can reach the application's HTTP interface, because the Security component does not properly restrict what an authenticated but unprivileged session can do. Successful exploitation yields full compromise of confidentiality, integrity and availability of the HFM application, meaning an attacker could read, alter or destroy financial consolidation data and gain administrative control of the deployment. The flaw is rated 8.8 on CVSS 3.1; no public exploit code or CISA KEV listing was present in the source data at time of analysis, so this is currently a patch-now, monitor-for-exploitation issue rather than a confirmed actively exploited one.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-component flaw that lets a low-privileged, network-connected user take full control of the application over HTTP. Per the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), exploitation requires only a valid low-privilege account and no user interaction, but delivers complete compromise of confidentiality, integrity and availability. There is no public exploit code or CISA KEV entry in the supplied intelligence at time of analysis; the only consolidated signal is Oracle's own security alert, and separate risk scores (EPSS) were not provided.
Improper access control in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds high privileges and can reach the application over the network submit crafted SQL to read, create, delete, or modify critical financial consolidation data. The CVSS 3.1 base score is 8.7 with a scope change, meaning a successful attack can extend beyond the HFM component into interconnected products that share credentials or database access. Oracle shipped a fix in its September 2026 Critical Security Patch Update, and no public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged user with network access over HTTP read critical financial data and make limited unauthorized modifications, with a scope change that can expose other connected Oracle products. Oracle rates it CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), meaning exploitation requires only a low-privileged authenticated session — not administrative rights — and no user interaction. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied with the available data, so real-world exploitation likelihood is unquantified at this time.
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management Security component over TCP can bypass authentication and gain unauthorized access to, and modification of, all data managed by the affected deployment. The flaw is rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and affects only version 11.2.26.0.000; there is no availability impact, so the exposure is full compromise of confidentiality and integrity rather than denial of service. At time of analysis there is no public exploit identified, though CISA's SSVC assessment marks the flaw as fully automatable with total technical impact, so a patch should be prioritized ahead of any observed exploitation.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a pre-authentication defect in its Security component that allows remote, unauthenticated attackers with TCP network access to bypass authentication and gain full read/write access to all HFM data. The flaw is rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials, no user interaction, and no non-default configuration are required - only network reachability to the HFM tier, which in most enterprises sits behind the perimeter rather than internet-facing. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as 'none,' though the flaw is rated automatable with total technical impact, so an exploit, once developed, would likely be reliable and repeatable across exposed instances; availability is unaffected (A:N), so the threat is data theft and tampering rather than denial of service.
Unauthenticated remote attackers can bypass authentication in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000, obtaining complete read access to the financial consolidation and reporting data the application can reach, plus limited unauthorized modification. Oracle's own advisory rates it 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), placing it in the most dangerous class of EPM flaws because no credentials or user interaction are needed. The supplied intelligence contains no EPSS score, no CISA KEV entry and no public exploit code, so active exploitation is not confirmed.
Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Financial Management 11.2.26.0.000 via TCP, gaining full read and write access to critical data (CVSS 9.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, CWE-287). The flaw resides in the Security component and requires only network reachability of the affected service, with no user interaction or privileges needed; CISA SSVC rates exploitation as 'none' and automatable. No public exploit code was identified at time of analysis, and while HFM is typically deployed internally behind the corporate perimeter, the high base score and total technical impact warrant urgent patching for exposed instances.
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a valid low-privilege application account and can reach the product's HTTP interface, because the Security component does not adequately enforce privilege boundaries (assessed CVSS 3.1 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). No user interaction is required, and the scope change (S:C) means a successful compromise can significantly impact additional integrated products that trust HFM, widening the blast radius well beyond the vulnerable host itself. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the risk is driven by the trivial exploitation path available to anyone who can obtain a low-privilege login rather than by observed active exploitation.
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management 11.2.26.0.000 Security component over HTTPS can bypass its authentication controls and gain read and write access to critical financial data, with the exploit's impact crossing into other integrated Oracle EPM products (scope change). Oracle rates this CVSS 3.1 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), explicitly noting it is difficult to exploit; no public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided. The practical concern is data integrity and confidentiality of consolidation records rather than remote code execution, since availability impact is rated None.
Unauthenticated remote attackers with HTTP access can exploit improper authentication in Oracle Hyperion Financial Management 11.2.26.0.000 to read, create, delete, or modify all data accessible through the application. The Security-component flaw carries CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is fully automatable with total technical impact, though no public exploit or active exploitation is identified at time of analysis; exposure is chiefly constrained by whether the HFM web tier is reachable from attacker networks.
Full compromise of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, targeting the Security component to gain complete control over confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 reflects the combination of network accessibility, low attack complexity, and no user interaction required beyond a valid low-privilege account. No public exploit code or CISA KEV listing has been identified at time of analysis, though the severity of the stated outcome - full system takeover - warrants immediate patch application.
Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker exploiting a flaw in the Security component, with confirmed scope change enabling impact on additional adjacent products. The CVSS vector (AV:L/AC:H/PR:H) reflects a difficult-to-exploit, infrastructure-local attack requiring significant access prerequisites, yet successful exploitation yields complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is best understood as an insider or post-compromise escalation threat rather than an opportunistic remote attack.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a Security component flaw - tagged as an authentication bypass - that enables low-privileged authenticated attackers to gain complete read access to all data within the application and limited write access, with a confirmed scope change extending impact to additional Oracle Hyperion suite products. Exploitation requires human interaction from a victim but carries low attack complexity and is reachable over HTTP without elevated privileges. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is possible via a network-accessible HTTP attack against the Security component. The CVSS vector confirms no authentication, no user interaction, and no special conditions are required, placing this squarely in the high-severity, easily exploitable category. Successful exploitation yields complete read access to all data accessible by the application and a partial denial of service, making this a critical risk for financial institutions running the affected build. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by a network-accessible, high-privileged attacker exploiting a flaw in the Security component via HTTP. The vulnerability carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, amounting to effective product compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and complete CIA triad impact warrant prompt remediation attention.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker targeting the Security component over HTTP, resulting in complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 7.5 (High) reflects this total impact, though high attack complexity (AC:H) constrains opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS data was supplied in the source intelligence.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker via TCP, with no user interaction required. The vulnerability resides in the Security component and results in complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible lateral-movement risk in enterprise financial environments.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 allows unauthenticated, network-adjacent attackers to fully read and manipulate sensitive financial consolidation data without any credentials. The affected component is HFM's Security subsystem, and exploitation requires only adjacency to the physical or logical network segment hosting the application - no user interaction or privileges needed. No public exploit code and no CISA KEV listing exist at time of analysis, though the low attack complexity makes this straightforward to exploit for any attacker achieving network adjacency.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged network attackers to bypass security controls and gain complete access to sensitive financial data via HTTP. Tagged as an Authentication Bypass in EUVD-2026-61889, the flaw carries a CVSS scope change indicator meaning successful exploitation can extend confidentiality impacts to additional Oracle Hyperion products sharing the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's own designation of this as 'easily exploitable' and the low attack complexity are meaningful risk signals for organizations running this financial consolidation platform.
Full system takeover is achievable in Oracle Hyperion Financial Management 11.2.25.0.000 through a flaw in its Security component, exploitable over HTTP by any low-privileged attacker with network access and no required user interaction. The CVSS 3.1 score of 8.8 reflects complete high-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.