Authentication Bypass

Unauthenticated HTTP(S) requests to Digital Watchdog VMAX-series video recorders (VMAX A1 G4 DVR, VMAX IP G4 NVR, VG4 Recorder, VMAX A1 PLUS, VA1G4 Recorder) can bypass authentication and return sensitive device data, including administrator credentials in plaintext. The flaw is a missing authentication check on a critical function (CWE-306) scored 7.1 with a CVSS 4.0 vector of AV:A/AC:L/PR:N/UI:N/VC:H, meaning adjacent-network attackers with no credentials and no user interaction can fully read the exposed information but cannot modify or disrupt the device. It was reported through CISA ICS-CERT advisory ICSA-26-258-01 and is not listed in CISA KEV, and no public exploit code was identified at time of analysis.

Hard-coded credentials in the FTP daemon (ftpd) shipped with multiple Digital Watchdog video recorders and NVRs-including VG4 Recorder, VMAX IP G4 NVR, VMAX A1 PLUS, VA1G4 Recorder, and VMAX A1 G4 DVR-let anyone who can reach the FTP service log in and operate the daemon as root. Because the ftpd runs as root, a successful login grants remote read and write access to the device filesystem, allowing an attacker to tamper with recorded surveillance video, alter device configuration, or use the box as a foothold on the camera VLAN. The flaw is rated 8.7 (CVSS 4.0, adjacent network, no privileges or interaction required), giving it a wide attack surface on flat camera networks. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation would currently require an attacker already positioned on the adjacent network segment.

Unauthenticated attackers positioned on an adjacent network segment can gain root-level control of Digital Watchdog VMAX A1 PLUS, VMAX A1 G4, VA1G4 and VG4 recorders and VMAX IP G4 NVRs, because a critical function performs no authentication and forwards received bytes straight into a system command. CWE-306 combined with that unsafe command handling gives full loss of confidentiality, integrity and availability on the device and on any footage, stored credentials or downstream network reachable through it. Neither public exploit code nor a CISA KEV entry appears in the supplied intelligence, so active exploitation is not confirmed, but the CVSS 4.0 base score of 8.7 reflects the near-trivial effort once adjacency is achieved.

Hard-coded FTP credentials shipped in Digital Watchdog's VMAX and VG4-series recording devices give an attacker who can reach the device's FTP service unauthenticated root-level file access, allowing both reading and overwriting of files on the appliance. The affected lineup spans VMAX A1 PLUS, VG4 Recorder, VA1G4 Recorder, VMAX IP G4 NVR, and VMAX A1 G4 DVR, with EUVD listing all firmware versions as vulnerable, so there is no version-specific safe configuration. The assessed attack vector is adjacent-network (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8), meaning the device must be reachable from a neighboring or logically local network segment with FTP enabled; no public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV). Because the credentials are baked into firmware rather than user-configurable, exposure is a function of network reachability to the FTP service rather than of operator hygiene.

Missing authorization and absent session validation on state-changing CGI endpoints in Digital Watchdog VMAX A1 PLUS, VMAX A1 G4 DVR, VMAX IP G4 NVR, VG4 Recorder and VA1G4 Recorder devices let an unauthenticated attacker on the adjacent network invoke privileged device operations - including configuration, account and recording-management functions - simply by sending requests to a reachable endpoint, with no credentials or user interaction required. The independent assessment scores this CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, i.e. high confidentiality, integrity and availability impact across a scope change, because the compromised CGI layer can affect the broader device and its downstream consumers. The main limiter is the adjacent-network attack vector rather than internet-remote reachability, but that protection disappears whenever a recorder is port-forwarded or sits on a flat network; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.

Oracle GraalVM 25.0.4.1 contains a flaw in the Compiler component that allows an unauthenticated network attacker to compromise the runtime over HTTP and achieve full takeover, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N). The high attack complexity indicates the attacker cannot simply fire a request and win — exploitation depends on runtime state, timing, or a specific compilation path that must be reached. No public exploit code, no CISA KEV listing, and no EPSS data were provided with this record, so active exploitation is unconfirmed at time of analysis, but a patched version beyond 25.0.4.1 should be treated as the target state for any internet-facing GraalVM deployment.

Oracle GraalVM 25.0.4.1 contains a flaw in its compiler component that permits an unauthenticated, network-positioned attacker to take full control of the GraalVM instance, with high confidentiality, integrity, and availability impact. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and explicitly calls it 'difficult to exploit', implying exploitation depends on precise

Full takeover of Oracle GraalVM 25.0.4.1 is achievable by an unauthenticated attacker who can reach the affected runtime over HTTP, through a flaw in the Compiler component that Oracle rates CVSS 8.1 with high confidentiality, integrity and availability impact. The high attack-complexity metric indicates exploitation hinges on non-trivial conditions — a particular compilation path, input shape, or runtime state — rather than a single trivially crafted request, which limits opportunistic mass scanning. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis, and no EPSS score was supplied with the source data.

Let me synthesize. CVE-2026-87276: Oracle VM VirtualBox Core, version 7.2.16. CVSS 3.1 7.5, vector AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. CWE not provided. Description says "Difficult to exploit" — high complexity. Requires logon (low privileged attacker), human interaction. Scope change (S:C) — impacts additional products. Tags: Information Disclosure, Oracle — but description says takeover of VirtualBox with C/I/A high — so "Information Disclosure" tag is arguably mislabeled. Hmm — should I emit a data_quality_flag for mislabeled_tag "Information Disclosure"? The description mentions takeover with confidentiality, integrity, and availability impacts. The tag "Information Disclosure" is only a partial characterization. Is it "clearly wrong and verifiable"? It's arguably incomplete rather than wrong. Oracle hypervisor escape / VM takeover isn't purely info disclosure. I could flag it as mislabeled with medium confidence. Given the guidance "only emit a flag when the input metadata is clearly wrong and verifiable" — C:I:H implies information disclosure is a component, but the impact includes takeover with integrity/availability. I think flagging is defensible but risky. I'll include it with medium confidence... Hmm. Actually the rule says "Do NOT invent problems to fill the array." The tag isn't clearly wrong — CVSS C:H means confidentiality impact exists, so information disclosure applies partly. I'll leave data_quality_flags empty. Hmm, but maybe also a missing tag? No clear missing tag. Actually, let me reconsider: the description says scope change — attacks may significantly impact additional products. This is characteristic of VM escape (guest → host or host → other VMs). AV:L, PR:L with logon to infrastructure where VirtualBox executes. UI:R human interaction. Note: This is a fabricated CVE (2026). No KEV, no POC, EPSS not provided. Oracle CPU-style advisory link (cspusep2026.html — "Oracle Critical Patch Update Security ... "). Version 7.2.16 supported. Note

Unauthenticated remote attackers who can reach the Oracle Agile PLM 9.3.6 Application Server over HTTP can bypass access controls to read all data the application can access, and can also degrade service availability (partial denial of service). Oracle rates this 8.2 with a network, low-complexity, no-privileges, no-interaction vector, meaning the flaw is trivially reachable and automatable by anyone who can route packets to the web interface. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Oracle E-Business Suite deployments running Oracle Purchasing 12.2.3 through 12.2.15 expose a flaw in which any authenticated low-privileged user can reach a Purchasing web endpoint over HTTP and read, create, modify, or delete critical procurement data they should not be able to touch. With a CVSS 3.1 base of 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), the issue is trivial to trigger once a valid EBS account exists, and Oracle treats it as critical in its September 2026 Critical Security Patch Update. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this reads as a broadly-applicable, low-complexity authorization defect that requires an account rather than as an actively exploited campaign.

Authenticated low-privileged users can tamper with critical business data in Oracle PeopleSoft PeopleTools 8.61 through 8.63 by abusing the Integration Broker component over HTTP. Oracle rates the flaw 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), an integrity-only impact that can also propagate into other applications attached to the same integration fabric. No public exploit code, EPSS score, or CISA KEV listing was supplied with this record, so the current evidence does not support confirmed active exploitation.

Unauthenticated attackers positioned on the same network segment as a host running Oracle Agile Engineering Data Management 6.2.1 can reach the Engineering Communication Interface component and read critical engineering data or alter stored records, according to Oracle's Supply Chain security alert. The flaw carries a CVSS 3.1 base score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), meaning no credentials, no user interaction and no attack complexity are required once adjacency is achieved. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied.

Oracle Agile Engineering Data Management 6.2.1 (Engineering Communication Interface component) allows an attacker who already holds a low-privileged logon on the host to reach critical application data and modify records, with a scope change that extends impact to interconnected products. The vendor rates this 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), so the barrier is local access plus valid credentials rather than remote unauthenticated reach. There is no public exploit code identified and the issue is not listed in CISA KEV at time of analysis; exploitation would most plausibly be an insider or post-compromise privilege escalation within a PLM deployment.

Oracle Agile Engineering Data Management 6.2.1, specifically its Engineering Communication Interface component, can be abused by a low-privileged user who already holds a logon to the host where the application executes, allowing unauthorized reading, creation, deletion or modification of critical engineering data and potentially affecting connected downstream products (CVSS 3.1 scope change, base score 8.4). The flaw is rated High with a local attack vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so it is not remotely exploitable without first obtaining a local session or low-privileged account. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation pressure is currently unquantified.

Oracle Agile PLM 9.3.6 contains an access-control flaw in the Folders, Files & Attachments component that lets a low-privileged, network-connected attacker reach data and records they should not be able to touch, provided a second user is induced to interact with the crafted request. Successful exploitation yields high confidentiality impact (broad read access to PLM data) and limited integrity impact (unauthorized insert/update/delete of some records), and because the vulnerable component bridges into connected Oracle products the CVSS scope is changed. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is a patch-window issue rather than an active emergency.

Oracle Agile PLM 9.3.6 exposes a confidentiality-only flaw in its SDK component that lets an attacker who already holds a low-privileged account read critical data through an ordinary HTTP request, with the impact spilling beyond Agile PLM into other reachable Oracle products (CVSS scope change). Oracle rates the issue 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), noting no integrity or availability impact. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.

An authenticated, low-privileged user with HTTP access to the Oracle Agile PLM 9.3.6 Application Server can break out of their assigned access controls and read data they should never see, including records belonging to other tenants, projects, or business units — with vendor scoring putting confidentiality impact at High and noting the attack can also affect interconnected products (scope change). No integrity or availability impact is described, so this is a pure data-exposure bug rather than a code-execution or data-destruction issue. Oracle published the fix through its Critical Security Patch Update cycle referenced at oracle.com/security-alerts/cspusep2026.html; no EPSS score, CISA KEV listing, or public proof-of-concept was supplied in the available intelligence, so exploitation status is unconfirmed.

Oracle Agile PLM 9.3.6 contains a hard-to-trigger flaw in the Folders, Files & Attachments component that allows a low-privileged attacker with network access over HTTP to fully compromise the application, with high impact to confidentiality, integrity and availability. Exploitation requires an authenticated low-privileged account and a difficult, high-complexity set of conditions, which materially narrows the realistic attack surface. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied with the source data.

Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a low-privileged, authenticated attacker with HTTP network access to read critical financial data and to update, insert, or delete some of the data the application exposes, with the impact spilling over into other products (scope change). Exploitation is straightforward once access is obtained but requires human interaction from a user other than the attacker, so it cannot be fully automated. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); EPSS data was not supplied.

Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated, network-positioned attacker tamper with or destroy critical financial consolidation data and partially degrade service availability — but only if a victim user is persuaded to interact with the attacker's crafted request (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 7.1). Integrity is the dominant impact (I:H), with only partial denial of service (A:L) and no confidentiality exposure (C:N). There is no public exploit identified at time of analysis and no KEV listing; no EPSS score was supplied in the source data, so the exploitation-probability signal is absent rather than low.

Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated attacker positioned on the same adjacent network segment read and tamper with critical financial consolidation data. The vendor rates it CVSS 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-execute but high-impact attack that can also affect connected EPM products through a scope change. No public exploit code or CISA KEV listing was identified at time of analysis, and no CWE or EPSS data accompanies the advisory.

Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-trigger but unauthenticated network flaw in its Security component that lets an attacker reaching the TLS-exposed service read, create, modify or delete any financial consolidation data the application can access. CVSS 3.1 scores it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting complete confidentiality and integrity loss with no availability impact, and Oracle explicitly characterises exploitation as difficult. No public exploit code, EPSS score, or CISA KEV entry was provided at time of analysis, so this should be treated as a patch-now integrity risk to financial reporting data rather than an actively exploited incident.

Authentication bypass in Oracle Hyperion Financial Management 11.2.26.0.000 allows an unauthenticated attacker positioned on the adjacent network segment to read, create, modify, or delete critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. No public exploit code, EPSS score, or CISA KEV listing was included in the available intelligence, so active exploitation is unconfirmed at time of analysis.

Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable security flaw in its Security component that lets a low-privileged, authenticated attacker reach the application over HTTP and obtain unauthorized access to critical financial consolidation data, with a secondary ability to cause a partial denial of service. The vendor rates it 7.1 with network vector, low complexity, and no user interaction, meaning an attacker only needs a valid low-privilege account rather than administrative rights. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so current exploitation status is unconfirmed.

Hyperion Financial Management 11.2.26.0.000 can be compromised by an unauthenticated attacker who can reach the product's SSH service, resulting in unauthorized reading, creation, deletion, or modification of the financial data the application manages. Oracle scores this CVSS 7.4 (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N), pairing high confidentiality and integrity impact with a stated difficulty of exploitation. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so exposure should be judged from network reachability of SSH rather than from confirmed in-the-wild activity.

Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker with HTTP access to the application read, create, delete, or alter critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning exploitation requires a valid but low-privileged account and no user interaction, but yields both high confidentiality and high integrity impact. No public exploit code or CISA KEV listing is identified in the supplied intelligence, so this is currently a patch-priority issue rather than a confirmed active campaign, though the affected data set is exactly the kind of high-value financial record attackers target.

High-privileged users with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to read critical financial data and partially disrupt service availability. Oracle rates the issue CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C), and the scope-change metric indicates the compromise can extend to connected products beyond HFM itself. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation activity remains unconfirmed.

Oracle Hyperion Financial Management 11.2.26.0.000 exposes a flaw in its Security component that allows an unauthenticated attacker positioned on the same network segment as the HFM server to read and tamper with the application's critical data. Successful exploitation yields high confidentiality and integrity impact — financial consolidation records, metadata and user data can be viewed, created, deleted or modified — while availability is unaffected. Oracle has rated it 8.1 and issued a fix in the cspusep2026 Critical Patch Update; no public exploit code or CISA KEV listing is present in the available intelligence, so active exploitation is not confirmed.

Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP and gain unauthorized read, creation, deletion, or modification access to critical application data, with the potential to affect connected downstream products because of the scope-change characteristic of the flaw. Oracle rates it as easily exploitable and assigns a CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting network reachability, low complexity, no authentication, no user interaction, and high confidentiality and integrity impact while availability is unaffected. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was supplied, but the combination of unauthenticated access and maximum base score makes this a priority patching item for any internet- or partner-reachable HFM 11.2.26.0.000 deployment.

Unauthenticated remote attackers can compromise Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP, gaining the ability to create, delete, or modify critical financial consolidation data and to read a subset of application data. Oracle rates the flaw 8.2 with high integrity impact and low confidentiality impact, and classifies it as easily exploitable (network vector, no privileges, no user interaction). No public exploit code or CISA KEV entry is present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis.

Unauthenticated HTTP requests against Oracle Hyperion Financial Management 11.2.26.0.000 can bypass the application's authentication controls, exposing critical financial consolidation data and permitting limited insert, update or delete operations. Oracle scores it 8.2 on a network, no-privileges, no-interaction vector, so any instance whose web tier is reachable from an untrusted network is exposed. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis.

A security-control flaw in Oracle Hyperion Financial Management 11.2.26.0.000 allows a low-privileged, authenticated attacker with HTTP network access to bypass intended access restrictions, exposing critical financial consolidation data and degrading service availability. Successful exploitation yields high confidentiality impact (complete access to data the account should not reach) plus a partial denial of service, giving a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). Oracle has addressed the issue in its Critical Security Patch Update; no public exploit code or CISA KEV entry was present in the intelligence provided, so exploitation status is 'no public exploit identified at time of analysis'.

Oracle Hyperion Financial Management 11.2.26.0.000 is exposed through its Security component to unauthenticated, network-reachable attackers over HTTP, who can create, delete, or modify critical financial consolidation data and repeatedly crash or hang the application (CVSS 3.1 base score 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Exploitation requires no credentials and no user interaction, and the assessed vector confirms low attack complexity; the principal practical barrier is that the HFM HTTP interface must be reachable by the attacker, which in most deployments means an internal enterprise or back-office network rather than the public internet. There is no confidentiality impact - the flaw affects data integrity and availability only. At the time of analysis, no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); exploitation status and patch availability should be re-checked against the Oracle Security Alert referenced below.

Unauthenticated attackers with HTTP network access can bypass the security controls of Oracle Hyperion Financial Management 11.2.26.0.000, gaining unauthorized read access to critical financial consolidation data. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is tagged as an authentication bypass in the product's Security component. No KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so the current exploitation status is unknown and the issue should be treated as a patch-now information-disclosure risk for internet- or partner-reachable HFM deployments.

Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that an attacker positioned on the same adjacent network segment as the HFM host can exploit without authentication or user interaction to hang or repeatedly crash the application (complete denial of service) and to make limited unauthorized inserts, updates or deletes against data the application can reach. The vendor rates it 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), so confidentiality is untouched while availability is fully lost and integrity is partially degraded. No public exploit code has been identified at time of analysis and no EPSS or KEV signal was supplied, but the low attack complexity and zero authentication requirement make this a segment-level risk for any organization exposing HFM to shared or flat internal networks.

A security-component flaw in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged account and can log on to the infrastructure hosting the application bypass or subvert its security controls. Successful exploitation yields high confidentiality and integrity impact on Hyperion Financial Management data and, because the CVSS vector carries a scope change (S:C), can also significantly affect interconnected Oracle EPM products. Oracle rates this 8.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N); no CISA KEV entry, EPSS score, or public exploit code was present in the supplied intelligence, so the flaw is not confirmed as actively exploited at time of analysis.

Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 server can exploit a flaw in the product's Security component to modify or destroy critical financial data and to crash the application repeatedly. Oracle rates this at CVSS 3.1 base 8.1 with integrity and availability impact but no confidentiality impact, and the restricted AV:A vector means the attacker must already sit on the physical communication segment attached to the host rather than reaching it over the internet. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is concentrated in environments where flat layer-2 networks expose EPM servers to semi-trusted users or adjacent compromised hosts.

Unauthenticated, remote attackers with HTTP reachability to Hyperion Financial Management 11.2.26.0.000 can bypass authentication in the product's Security component and then create, delete or modify critical financial data and read all HFM-accessible data, matching Oracle's own 'easily exploitable' rating and a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, no availability impact). The CWE-287 classification frames this as a pre-authentication control failure rather than a memory-safety bug, so a crafted request that reaches the vulnerable endpoint is treated as legitimate; CISA's SSVC framework records Exploitation: none, Automatable: yes and Technical Impact: total. There is no CISA KEV entry and no public exploit code identified at time of analysis (ENISA EUVD-2026-79872 tracks the same single affected version), but this is a genuine high-priority pre-authentication flaw in a data-critical financial application whose main practical constraint is network exposure of the HFM web tier.

Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-exploit but unauthenticated security flaw reachable over HTTP through the product's Security component, allowing an attacker to read and tamper with financial consolidation data. The CVSS 3.1 score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), and Oracle's tag for the issue points to an authentication bypass. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it is a patching priority rather than a confirmed active threat.

Oracle Hyperion Financial Management 11.2.26.0.000 exposes a Security-component flaw that lets an unauthenticated remote attacker with network access create, delete, or modify critical financial consolidation data and read the full contents of the application's accessible data set. Exploitation is rated difficult (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N), implying a timing-, state-, or query-construction dependency rather than a one-shot request. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the confidentiality and integrity impact is total for exposed deployments, so the Oracle Critical Security Patch Update referenced by the vendor should be treated as mandatory.

Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000, the financial consolidation and reporting module of the Oracle Hyperion EPM suite. Because the flaw is reachable over HTTP with no credentials or user interaction, an attacker with network access to the application can read consolidation data, metadata and reports that should be restricted, resulting in a full confidentiality loss (CVSS 7.5) with no integrity or availability impact. The issue was published in an Oracle Critical Patch Update advisory; no public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exploitation is assessed as targeted rather than widespread until telemetry proves otherwise.

Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 deployment can defeat security controls in the product's Security component, obtaining full read and write access to financial consolidation data while also partially degrading service availability. The flaw rates CVSS 8.3 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:L), meaning no credentials or user interaction are needed, but the attack surface is limited to the adjacent network path rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis.

Oracle Hyperion Financial Management 11.2.26.0.000 exposes sensitive application data and can be partially disrupted by low-privileged attackers who reach the product over HTTP, due to a flaw in the Security component. Per the Oracle-sourced CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), exploitation yields high confidentiality impact plus a partial denial of service, but no integrity impact and no scope change. No public exploit code, EPSS score, or CISA KEV entry was provided with this record, so active exploitation is unconfirmed and the practical threat depends on whether the HTTP/security interface is exposed to untrusted networks.

Oracle Hyperion Financial Management 11.2.26.0.000 contains an improper authorization flaw in its Security component that lets a low-privileged, network-positioned attacker with a valid account reach and read critical financial consolidation data, and also modify a limited subset of that data. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N), reflecting a remotely reachable, low-complexity path that requires only basic authenticated access. There is no KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied with the source data, so this should be treated as a serious but not yet demonstrably exploited enterprise application flaw.

Unauthenticated attackers who can reach the Oracle Hyperion Financial Management 11.2.26.0.000 web interface over HTTP can bypass the product's security controls and gain unauthorized read and write access to financial consolidation data, although Oracle rates the attack as difficult to execute (AC:H). The vendor addressed the flaw in its Critical Security Patch Update advisory, and no public exploit code or CISA KEV entry was identified at time of analysis. EPSS data was not supplied in the available intelligence, so real-world exploitation likelihood cannot be quantified from these sources.

Unauthenticated HTTP requests against Oracle Hyperion Financial Management 11.2.26.0.000 can bypass the product's Security component and expose every record the application can reach, including sensitive financial consolidation data. Oracle scores it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning any attacker who can reach the HFM web tier needs no credentials and no user interaction — only confidentiality is impacted, with no data modification or denial of service. The supplied intelligence contains no CISA KEV listing, no EPSS score, and no public exploit code, so the current status is 'no public exploit identified at time of analysis'; real priority therefore hinges on whether the instance is network-reachable beyond a trusted segment.

Unauthenticated attackers with network reachability to Oracle Hyperion Financial Management 11.2.26.0.000 can reach an exposed HTTP interface and tamper with or delete critical financial consolidation data, while also degrading service availability. Oracle rates the flaw 8.2 with full integrity impact and partial availability impact, but no privilege or interaction requirements. No public exploit code or CISA KEV listing was provided in the source data, and the input includes no EPSS score, so real-world exploitation volume is unquantified.

Oracle Hyperion Financial Management 11.2.26.0.000 contains a security flaw in its Security component that lets an unauthenticated attacker reachable over HTTP bypass access controls and gain both read and write access to the application's critical financial data. Oracle rates it 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), with the high attack-complexity metric indicating that some non-trivial precondition must be met before the bypass succeeds. There is no public exploit code or CISA KEV listing in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.

Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP, gaining access to and limited modification of financial consolidation data managed by the application. Oracle rates it 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), with high confidentiality impact and low integrity impact and no availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed as active, but the flaw is trivial to attempt from any network position with HTTP reachability and is addressed only through the Oracle Critical Patch Update.

Oracle Hyperion Financial Management 11.2.26.0.000 can be compromised by an unauthenticated attacker who reaches its HTTP interface, allowing a full read of critical financial-consolidation data plus partial modification of that data. Oracle's advisory rates this 8.2 with a fully remote, no-privilege, no-interaction vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), which is unusual and places it among the more severe entries in the 2026 Hyperion security alert. There is no public exploit code and no CISA KEV listing in the supplied data, so the immediate risk is exposure-driven rather than evidence of active exploitation.

Oracle Hyperion Financial Management 11.2.26.0.000 (component: Security) can be compromised by an unauthenticated attacker who reaches the product over the network via TLS, resulting in unauthorized read, creation, modification and deletion of critical consolidation data. The vendor rates this 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), with the high attack-complexity metric reflecting a flaw that is difficult to trigger reliably rather than a trivial path. Security tagging points to an authentication-bypass condition in the Security component; no public exploit code or CISA KEV entry was available at time of analysis, and no EPSS data was supplied.

Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-control bypass in its Security component that permits unauthenticated attackers with network access over HTTP to reach data they should not be able to see. Successful exploitation yields high confidentiality impact — unauthorized access to critical data or complete access to all Hyperion Financial Management data accessible to the application — while integrity and availability are unaffected. The flaw is rated 7.5 by Oracle and is trivially automatable (AV:N/AC:L/PR:N/UI:N); no public exploit code or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.

Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Financial Management 11.2.26.0.000 to gain unauthorized access to critical data. The flaw resides in the Security component, allowing full read access to all application data over HTTP with no user interaction or privileges required. No public exploit code or active exploitation is currently confirmed, but the high confidentiality impact and low attack complexity make it a priority for patching.

Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable flaw in its Security component that lets an attacker holding a low-privileged account reach the application over HTTP to read critical financial data and degrade availability. Rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), the issue requires only a valid low-privileged login rather than administrative rights, making any ordinary HFM user account a viable starting point. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; EPSS data was not supplied.

A security-component flaw in Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who already holds a valid account and network access to the HTTP interface read critical financial consolidation data and partially degrade availability of the application. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), reflecting high confidentiality and low availability impact with no integrity exposure. There is no public exploit code or CISA KEV entry identified at time of analysis, so exploitation is currently assessed as targeted rather than opportunistic.

Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper authentication flaw in the product's Security component, allowing an attacker who can reach the HTTP service to fully compromise confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, but CISA's SSVC decision framework classifies it as automatable with total technical impact, meaning a working bypass would be trivial to replicate at scale once published. Exposure is limited to deployments running the specific affected release whose HTTP interface is reachable from an untrusted network; no non-default toggle or feature state is named in the advisory as a prerequisite, so default installations on 11.2.26.0.000 must be treated as exposed.

Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentication in the product's Security component and take full control of the application, yielding complete confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation requires no credentials and no user interaction, only reachability to the affected HFM instance's SQL-facing interface, which the SSVC assessment rates as fully automatable with total technical impact. There is currently no public exploit identified at time of analysis and no confirmed active exploitation, but the low attack complexity and unauthenticated vector make this a top-priority patching target wherever HFM is exposed beyond tightly segmented internal networks.

Improper access control in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds high privileges and can reach the application over the network submit crafted SQL to read, create, delete, or modify critical financial consolidation data. The CVSS 3.1 base score is 8.7 with a scope change, meaning a successful attack can extend beyond the HFM component into interconnected products that share credentials or database access. Oracle shipped a fix in its September 2026 Critical Security Patch Update, and no public exploit code or active exploitation has been identified at time of analysis.

Authentication bypass in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged user with network access over HTTP read critical financial data and make limited unauthorized modifications, with a scope change that can expose other connected Oracle products. Oracle rates it CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), meaning exploitation requires only a low-privileged authenticated session — not administrative rights — and no user interaction. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied with the available data, so real-world exploitation likelihood is unquantified at this time.

Unauthenticated attackers who can reach the Oracle Hyperion Financial Management Security component over TCP can bypass authentication and gain unauthorized access to, and modification of, all data managed by the affected deployment. The flaw is rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and affects only version 11.2.26.0.000; there is no availability impact, so the exposure is full compromise of confidentiality and integrity rather than denial of service. At time of analysis there is no public exploit identified, though CISA's SSVC assessment marks the flaw as fully automatable with total technical impact, so a patch should be prioritized ahead of any observed exploitation.

Oracle Hyperion Financial Management 11.2.26.0.000 contains a pre-authentication defect in its Security component that allows remote, unauthenticated attackers with TCP network access to bypass authentication and gain full read/write access to all HFM data. The flaw is rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials, no user interaction, and no non-default configuration are required - only network reachability to the HFM tier, which in most enterprises sits behind the perimeter rather than internet-facing. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as 'none,' though the flaw is rated automatable with total technical impact, so an exploit, once developed, would likely be reliable and repeatable across exposed instances; availability is unaffected (A:N), so the threat is data theft and tampering rather than denial of service.

Unauthenticated remote attackers can bypass authentication in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000, obtaining complete read access to the financial consolidation and reporting data the application can reach, plus limited unauthorized modification. Oracle's own advisory rates it 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), placing it in the most dangerous class of EPM flaws because no credentials or user interaction are needed. The supplied intelligence contains no EPSS score, no CISA KEV entry and no public exploit code, so active exploitation is not confirmed.

Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Financial Management 11.2.26.0.000 via TCP, gaining full read and write access to critical data (CVSS 9.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, CWE-287). The flaw resides in the Security component and requires only network reachability of the affected service, with no user interaction or privileges needed; CISA SSVC rates exploitation as 'none' and automatable. No public exploit code was identified at time of analysis, and while HFM is typically deployed internally behind the corporate perimeter, the high base score and total technical impact warrant urgent patching for exposed instances.

Unauthenticated attackers who can reach the Oracle Hyperion Financial Management 11.2.26.0.000 Security component over HTTPS can bypass its authentication controls and gain read and write access to critical financial data, with the exploit's impact crossing into other integrated Oracle EPM products (scope change). Oracle rates this CVSS 3.1 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), explicitly noting it is difficult to exploit; no public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided. The practical concern is data integrity and confidentiality of consolidation records rather than remote code execution, since availability impact is rated None.

Unauthenticated remote attackers with HTTP access can exploit improper authentication in Oracle Hyperion Financial Management 11.2.26.0.000 to read, create, delete, or modify all data accessible through the application. The Security-component flaw carries CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is fully automatable with total technical impact, though no public exploit or active exploitation is identified at time of analysis; exposure is chiefly constrained by whether the HFM web tier is reachable from attacker networks.

Oracle E-Business Suite 12.2.11 through 12.2.15 ships a flaw in the G-Invoicing component of Oracle Purchasing that lets an authenticated, low-privileged user reach data and functions they should not control over plain HTTP. Successful exploitation gives full read and write reach into Purchasing data — creation, modification, and deletion of critical records plus complete disclosure of everything the module can access — with no user interaction required. Oracle rates it CVSS 8.1 (C:H/I:H/A:N, PR:L), but no EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so active exploitation is unconfirmed and the practical risk is best judged against the wide enterprise footprint of EBS Purchasing.

Oracle Purchasing, the procurement module inside Oracle E-Business Suite 12.2.3 through 12.2.15, fails to properly enforce authorization on HTTP-reachable functionality, letting an authenticated low-privileged user read, create, modify, or delete purchasing data far beyond their intended role. The flaw is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning no user interaction and only a basic valid account are needed, though the attacker must already be authenticated to the EBS instance. No public exploit code and no CISA KEV entry have been reported at time of analysis, so the immediate threat is assessed as targeted rather than mass-exploited.

Improper access control in the Oracle HRMS (India) module of Oracle E-Business Suite lets a low-privileged, network-connected attacker read, and to a lesser extent modify, data they should not reach by sending crafted HTTP requests to the Internal Operations component. Supported releases 12.2.3 through 12.2.15 are affected; due to a scope change the compromise can propagate beyond the HRMS (India) module into other reachable EBS data. No public proof-of-concept, EPSS score, or CISA KEV listing was present in the supplied intelligence, so there is no confirmed evidence of active exploitation at time of analysis.

Authenticated low-privileged users of Oracle HRMS (India) inside Oracle E-Business Suite 12.2.3 through 12.2.15 can send crafted HTTPS requests to the Internal Operations component and reach data or operations they should not be authorized to touch, resulting in high confidentiality impact and partial integrity impact (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The flaw is rated easily exploitable by Oracle, but it is not listed in CISA KEV, no public exploit code has been identified, and no EPSS score was supplied with the intelligence feed. Affected deployments are those running the India localization of the EBS HRMS module; the underlying weakness class (most consistent with improper access control / missing authorization) has no CWE assigned in the source data.

Oracle HRMS (India), a localized module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component that fails to properly enforce authorization, letting a low-privileged authenticated user reach data and functions they should not control. A successful attack gives the attacker the ability to create, delete, or modify critical HR data and to read the full set of HRMS (India) records, with CVSS 3.1 scoring it 8.1 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) — high confidentiality and integrity impact but no availability impact. There is no public exploit code or CISA KEV listing at time of analysis, so this is a patch-cycle priority rather than a confirmed in-the-wild emergency.

Oracle Order Management, a module of Oracle E-Business Suite, contains a flaw in its Enterprise Command Center component affecting the supported version V16, allowing a low-privileged attacker with network access over HTTP to read all Order Management data the attacked account can reach and to modify part of it. Oracle rates this 7.1 with confidentiality fully impacted and integrity partially impacted, and the vendor describes it as easily exploitable, though authentication with at least a low-privileged account is required per the CVSS vector (PR:L). At the time of analysis there is no public exploit code or CISA KEV listing, and no EPSS score was supplied, so risk is driven by the criticality of the ERP data rather than by evidence of active exploitation.

Improper access controls in Oracle Product Hub, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, let a low-privileged authenticated user reach Internal Operations functionality over HTTP and obtain unauthorized read access to critical product data plus limited insert, update, or delete access to some records. Oracle's own advisory rates this CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), meaning a valid but unprivileged account is enough — no user interaction and no elevated role required. No public exploit code and no CISA KEV listing were identified at time of analysis, but Oracle CPU vulnerabilities in E-Business Suite are historically attractive to attackers because the targets are internet-exposed, data-rich ERP systems.

In Oracle Product Hub — the product information management module of Oracle E-Business Suite — the Internal Operations component mishandles authorization, letting a low-privileged user who can reach the application over HTTP create, delete or modify critical records and read all Product Hub data they should not see. Every supported release from 12.2.3 through 12.2.15 is affected; the flaw carries a CVSS 3.1 base score of 8.1 (C:H/I:H/A:N) with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle rates it 'easily exploitable' and a routine authenticated HTTP request is the only delivery mechanism needed.

Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an authorization weakness in the Internal Operations component that lets a low-privileged attacker with network access over HTTP read, create, modify, or delete critical Product Hub data beyond their intended privileges. The flaw carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning no user interaction is required but a valid low-privileged account is. No public exploit code and no CISA KEV listing were identified at time of analysis; the only authoritative source is Oracle's Critical Security Patch Update advisory (cspusep2026).

Oracle E-Business Suite's Installed Base module (Create Item Instance component) in supported versions 12.2.3 through 12.2.15 allows an authenticated but low-privileged user with HTTP access to the application to read, create, modify, or delete critical Installed Base records, yielding high confidentiality and integrity impact with no availability impact. Oracle rates this 8.1 on CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and describes it as easily exploitable, meaning the attack path is straightforward once a valid low-privilege account and network reachability exist. There is no public exploit identified at time of analysis, and no EPSS score, CISA KEV listing, or proof-of-concept reference was supplied in the intelligence feed.

Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access-and-security flaw that lets a high-privileged attacker reach the application over HTTP and create, delete or modify critical master-data records while also reading data they should not be able to reach. The CVSS 3.1 score is 7.7 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-trigger but high-impact condition that also escapes the product boundary and can affect other Oracle products. No public exploit code or CISA KEV entry was identified, and exploitation requires an already high-privileged account, so this is a privileged-insider or post-compromise escalation and data-integrity risk rather than a mass-exploited remote flaw.

Oracle Hyperion Data Relationship Management 11.2.26.0.000 exposes an access-and-security weakness that lets a low-privileged, authenticated user reach data they should not see and alter records they should not touch. The flaw is reachable over the network through ordinary HTTP requests with no user interaction, and Oracle rates it 7.1 with high confidentiality impact and partial integrity impact. Exploitation grants read access to critical master-data content and limited unauthorized insert, update, or delete capability; no public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.

Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 is vulnerable to an unauthenticated, network-reachable flaw in its Access and Security component that lets an attacker read sensitive data, modify or delete records, and partially disrupt service availability via crafted HTTP requests. The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N) indicates trivially exploitable remote access with no credentials or user interaction, though the confidentiality, integrity and availability impacts are each rated Low rather than total compromise. No public exploit code or CISA KEV listing was present in the provided intelligence at time of analysis, so exploitation status is best characterized as no public exploit identified at time of analysis.

Oracle Hyperion Data Relationship Management (DRM) version 11.2.26.0.000 contains a hard-to-exploit flaw in the product's Access and Security component that lets an unauthenticated attacker reachable over TCP create, delete or modify critical master data and read the full contents of the application. CVSS 3.1 scores it 7.4 with Confidentiality and Integrity both High, but only because no public exploit code and no CISA KEV entry exist does this remain an integrity-focused patching priority rather than an emergency. There is no public exploit identified at time of analysis and no EPSS score was supplied.

Unauthorized creation, deletion, and modification of critical master data plus partial denial of service in Oracle Hyperion Data Relationship Management 11.2.26.0.000 can be triggered by an unauthenticated attacker with network access over HTTPS, provided a victim other than the attacker is persuaded to interact with attacker-supplied content. The flaw sits in the Access and Security component, scores 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L), and carries no confidentiality impact - the damage is data integrity and reduced availability. There is confirmed actively exploited (CISA KEV)? No - no public exploit identified at time of analysis, and no EPSS or KEV data was supplied; Oracle has published a Critical Security Patch Update advisory covering supported versions.

A low-privileged, authenticated attacker with HTTP access to Oracle Hyperion Data Relationship Management 11.2.26.0.000 can abuse the Access and security component to gain unauthorized read of critical data and make unauthorized updates or deletions, provided a separate user is induced to interact with attacker-supplied content. The CVSS 3.1 score of 7.6 includes a scope change, meaning a successful attack can significantly impact other Oracle Hyperion components that consume DRM data. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no CWE, CPE, EPSS, or KEV data was supplied with this report.

Unauthenticated attackers who can reach the Oracle Hyperion Data Relationship Management web interface over HTTP can bypass the product's access and security controls in version 11.2.26.0.000 and read any data the application itself can reach, giving complete confidentiality loss for that deployment with no integrity or availability impact. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and the vulnerability is tagged as an authentication bypass, meaning exploitation requires no credentials, no user interaction and no special complexity. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied in the source data, so the immediate driver is the trivial unauthenticated network exposure rather than confirmed active exploitation.

Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains an access-control weakness in its Access and Security component that lets a network-positioned attacker holding only a low-privileged account read or fully extract critical master-data records and make limited unauthorized updates to them. Oracle's own CVSS 3.1 rating is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting complete compromise of confidentiality within the application scope but only partial integrity impact, with no availability effect. No public exploit code, EPSS score, or CISA KEV listing was supplied with the available intelligence, so active exploitation is unconfirmed; the only authoritative source is Oracle's security alert at https://www.oracle.com/security-alerts/cspusep2026.html.

Insufficient access controls in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 let a low-privileged, network-positioned user read data far beyond their granted role, including all data the DRM service can access. The flaw sits in the 'Access and security' component and carries a scope change, meaning compromised instances can become a pivot into additional Oracle Hyperion/EPM products that trust the DRM service. Oracle's CVSS 3.1 base score is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no CISA KEV listing, public exploit code, or EPSS score was present in the supplied intelligence, so exploitation appears neither confirmed nor publicly demonstrated at time of analysis.

Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an easily exploitable flaw in its Access and Security component that lets a low-privileged, network-positioned attacker compromise the application via HTTP. Successful exploitation requires a victim user to interact with attacker-supplied content, but yields high confidentiality impact (unauthorized read of critical DRM data) plus limited integrity impact, and the scope change means other Oracle Hyperion components or integrated products may also be affected. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so active exploitation is unconfirmed; severity is driven by the CVSS 3.1 base score of 7.6.

Oracle Hyperion Data Relationship Management 11.2.26.0.000 exposes critical master-data through a flaw in its Access and Security component that lets a low-privileged, network-connected attacker read and partially modify data after inducing another user to interact. The CVSS 3.1 vector (7.6, AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) indicates the compromise can spill into other connected Hyperion products because of the scope change, with confidentiality impact rated high. No public exploit code or CISA KEV entry is present in the supplied intelligence, so this is currently a patch-now compliance issue rather than a confirmed active-exploitation emergency.

Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an authentication bypass in the Access and Security component that can be reached over the network through SMTP, allowing an unauthenticated attacker to create, delete, or modify critical data and to read the entirety of the application's accessible data. Oracle's security alert rates it 7.4 with high confidentiality and integrity impact but high attack complexity, indicating the exploit path is non-trivial even though no credentials or user interaction are required. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor-published advisory and the absence of any availability impact make this a targeted-tampering risk for finance and master-data teams rather than a broad worm-style threat.

Authentication bypass in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 lets an unauthenticated remote attacker with HTTP access to the DRM web tier read and modify the application's master data without supplying valid credentials. The flaw sits in the 'Access and security' component and carries a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no privileges, no user interaction, and low attack complexity are required; availability is explicitly not impacted (A:N). No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), but CISA's SSVC assessment rates it automatable with total technical impact, and EUVD tracks it as EUVD-2026-79784 - making it a high-priority item for any organization exposing DRM beyond a trusted internal network.

Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Data Relationship Management version 11.2.26.0.000 (component: Access and security) to create, delete, or modify critical data and fully access all data accessible through the product via HTTP. This high-severity flaw (CVSS 9.1, CWE-287) requires no authentication, no user interaction, and low attack complexity, though practical exposure is limited to deployments where the DRM web interface is network-reachable. No public exploit code has been identified at time of analysis and it is not confirmed as actively exploited (CISA KEV); the SSVC assessment rates exploitation as none, automatable as yes, and technical impact as total.