CVE-2026-71150
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in Oracle Hyperion Financial Management product (component: Security) version 11.2.25.0.000. Easily exploitable by low-privileged attacker via HTTP. Successful attacks can result in takeover of Oracle Hyperion Financial Management. CVSS 8.8.
Risk Assessment
Risk of complete takeover of financial system, potentially leading to serious data and operational breaches.
Recommendation
Apply vendor patches for version 11.2.25.0.000 and restrict access to the HTTP service.
Other vulnerabilities in Oracle Hyperion Financial Management
See all- CVE-2026-87230Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to compromise the system, with attacks potentially impacting additional products (scope change). It can result in unauthorized creation, deletion, or modification of critical data as well as unauthorized access to it. CVSS 3.1 Base Score 10.0.
- CVE-2026-87223Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to compromise the system, enabling unauthorized creation, deletion, or modification of critical data and causing a hang or frequently repeatable crash (complete DoS). CVSS 3.1 Base Score 9.1.
- CVE-2026-87217Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to compromise the system, enabling unauthorized creation, deletion, or modification of critical data as well as unauthorized access to it. CVSS 3.1 Base Score 9.1.
- CVE-2026-87214Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows a high-privileged attacker with HTTP network access to take over the system, with attacks potentially impacting additional products (scope change). CVSS 3.1 Base Score 9.1.
- CVE-2026-87189Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows a high-privileged attacker with Oracle Net network access to take over the system, with attacks potentially impacting additional products (scope change). CVSS 3.1 Base Score 9.1.
- CVE-2026-87188Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to fully take over the system. CVSS 3.1 Base Score 9.8.
- CVE-2026-87186Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running the system to take it over, with attacks potentially impacting additional products (scope change). CVSS 3.1 Base Score 9.6.
- CVE-2026-87184Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. An unauthenticated attacker with network access via SQL can easily exploit it, leading to takeover of the system. CVSS 3.1 Base Score 9.8.
- CVE-2026-87176Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. An unauthenticated attacker with network access via TCP can easily exploit it, leading to unauthorized creation, deletion, or modification of data and unauthorized access to data. CVSS 3.1 Base Score 9.1.
- CVE-2026-87175Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. An unauthenticated attacker with network access via TCP can easily exploit it, leading to unauthorized creation, deletion, or modification of data and unauthorized access to data. CVSS 3.1 Base Score 9.1.
Original NVD description (English source)
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS