cve-2026-70911
MEDIUM CVSS 5.3 opencve
Description
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Timeline
- Published
- 2026-08-18 21:17 UTC
- Last Modified
- 2026-08-24
CVSS Details
CVSS details not available.
Affected Products
No product information available.
CVSS metrics
| Version | Base | Severity | Vector | Exploitability | Impact | Source |
|---|---|---|---|---|---|---|
| 3.1 | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
mitre | ||
| 3.1 | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
nvd | ||
| 3.1 | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
opencve |
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cve": "CVE-2026-70911",
"enrichment": {
"affected": [
{
"configurations": [
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "generic",
"value": "11.2.25.0.000"
}
}
],
"enrichment": {
"confidence": 95.0,
"confidence_source": "inferred",
"scores": [
{
"score": 95.0,
"source": "inferred"
},
{
"score": 100.0,
"source": "matching"
}
]
},
"original": {
"product": "Oracle Hyperion Financial Management",
"source": "cna",
"vendor": "Oracle Corporation"
},
"product": "hyperion_financial_management",
"vendor": "oracle"
}
],
"created": "2026-08-19T04:15:03.459705+00:00",
"title": "Unauthenticated HTTP Data Disclosure in Oracle Hyperion Financial Management",
"updated": "2026-08-22T07:00:07.534406+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$hyperion_financial_management"
]
},
"epss": {
"score": 0.00337
},
"mitre": {
"cpes": [
"cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*"
],
"created": "2026-08-18T21:02:28.720000+00:00",
"description": "Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
"cvssV4_0": {}
},
"mitre_repo_path": "cves/2026/70xxx/CVE-2026-70911.json",
"references": [
"https://www.oracle.com/security-alerts/cspuaug2026.html"
],
"title": null,
"updated": "2026-08-22T02:21:49.604000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$hyperion_financial_management"
],
"weaknesses": []
},
"nvd": {
"cpes": [
"cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*"
],
"created": "2026-08-18T21:17:48.990000+00:00",
"description": "Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
"cvssV4_0": {}
},
"nvd_repo_path": "2026/CVE-2026-70911.json",
"references": [
"https://www.oracle.com/security-alerts/cspuaug2026.html"
],
"title": null,
"updated": "2026-08-24T15:48:27.917000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$hyperion_financial_management"
],
"weaknesses": [
"CWE-200"
]
},
"opencve": {
"changes": [
{
"created": "2026-08-18T21:15:00+00:00",
"data": [
{
"details": {
"new": "Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).",
"old": null
},
"type": "description"
},
{
"details": [
"oracle",
"oracle$PRODUCT$hyperion_financial_management"
],
"type": "first_time"
},
{
"details": {
"added": [
"cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*"
],
"removed": []
},
"type": "cpes"
},
{
"details": {
"added": [
"oracle",
"oracle$PRODUCT$hyperion_financial_management"
],
"removed": []
},
"type": "vendors"
},
{
"details": {
"added": [
"https://www.oracle.com/security-alerts/cspuaug2026.html"
],
"removed": []
},
"type": "references"
},
{
"details": {
"added": {
"cvssV3_1": {
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "f1277847-3621-48f8-9a5c-2ec41e37af8e"
},
{
"created": "2026-08-19T04:30:00+00:00",
"data": [
{
"details": {
"new": "Unauthenticated HTTP Access Allows Partial Data Disclosure in Oracle Hyperion Financial Management",
"old": null
},
"type": "title"
},
{
"details": {
"added": [
"CWE-200",
"CWE-285"
],
"removed": []
},
"type": "weaknesses"
}
],
"id": "91f39cc5-3aa7-4dd0-b964-0c6412d686bd"
},
{
"created": "2026-08-21T04:00:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Unauthenticated HTTP Access Allows Partial Data Disclosure in Oracle Hyperion Financial Management"
},
"type": "title"
},
{
"details": {
"added": [],
"removed": [
"CWE-200",
"CWE-285"
]
},
"type": "weaknesses"
}
],
"id": "e2ae006e-5008-49b6-b546-7546961e6826"
},
{
"created": "2026-08-21T06:15:00+00:00",
"data": [
{
"details": {
"new": "Unauthenticated HTTP Access Enables Confidential Data Disclosure in Oracle Hyperion Financial Management",
"old": null
},
"type": "title"
},
{
"details": {
"added": [
"CWE-284"
],
"removed": []
},
"type": "weaknesses"
}
],
"id": "5cd6f1c3-fb73-4f03-a73e-b051caf1776b"
},
{
"created": "2026-08-22T03:30:00+00:00",
"data": [
{
"details": {
"added": [
"CWE-200"
],
"removed": []
},
"type": "weaknesses"
},
{
"details": {
"added": {
"ssvc": {
"options": {
"Automatable": "yes",
"Exploitation": "none",
"Technical Impact": "partial"
},
"version": "2.0.3"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "8a82465d-0801-4aef-8469-5662329f620d"
},
{
"created": "2026-08-22T05:30:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Unauthenticated HTTP Access Enables Confidential Data Disclosure in Oracle Hyperion Financial Management"
},
"type": "title"
},
{
"details": {
"added": [],
"removed": [
"CWE-284"
]
},
"type": "weaknesses"
}
],
"id": "847e99f3-9682-4788-9723-69197a393504"
},
{
"created": "2026-08-22T07:15:00+00:00",
"data": [
{
"details": {
"new": "Unauthenticated HTTP Data Disclosure in Oracle Hyperion Financial Management",
"old": null
},
"type": "title"
}
],
"id": "d033638b-a5b8-4e24-8712-0307281b213f"
}
],
"cpes": {
"data": [
"cpe:2.3:a:oracle:hyperion_financial_management:11.2.25.0.000:*:*:*:*:*:*:*"
],
"providers": [
"mitre",
"nvd"
]
},
"created": {
"data": "2026-08-18T21:02:28.720000+00:00",
"provider": "mitre"
},
"description": {
"data": "Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).",
"provider": "mitre"
},
"metrics": {
"cvssV2_0": {
"data": {},
"provider": null
},
"cvssV3_0": {
"data": {},
"provider": null
},
"cvssV3_1": {
"data": {
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
"provider": "mitre"
},
"cvssV4_0": {
"data": {},
"provider": null
},
"epss": {
"data": {
"score": 0.00337
},
"provider": "first"
},
"kev": {
"data": {},
"provider": null
},
"ssvc": {
"data": {
"options": {
"Automatable": "yes",
"Exploitation": "none",
"Technical Impact": "partial"
},
"version": "2.0.3"
},
"provider": "vulnrichment"
},
"threat_severity": {
"data": null,
"provider": null
}
},
"references": {
"data": [
"https://www.oracle.com/security-alerts/cspuaug2026.html"
],
"providers": [
"mitre",
"nvd"
]
},
"title": {
"data": "Unauthenticated HTTP Data Disclosure in Oracle Hyperion Financial Management",
"provider": "enrichment"
},
"updated": {
"data": "2026-08-22T07:00:07.534406+00:00",
"provider": "enrichment"
},
"vendors": {
"data": [
"oracle",
"oracle$PRODUCT$hyperion_financial_management"
],
"providers": [
"mitre",
"nvd",
"enrichment"
]
},
"weaknesses": {
"data": [
"CWE-200"
],
"providers": [
"nvd",
"vulnrichment"
]
}
},
"vulnrichment": {
"cpes": [],
"created": "2026-08-18T21:02:28.720000+00:00",
"description": "Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {},
"kev": {},
"ssvc": {
"options": {
"Automatable": "yes",
"Exploitation": "none",
"Technical Impact": "partial"
},
"version": "2.0.3"
}
},
"references": [],
"title": null,
"updated": "2026-08-22T02:21:44.483000+00:00",
"vendors": [],
"vulnrichment_repo_path": "2026/70xxx/CVE-2026-70911.json",
"weaknesses": [
"CWE-200"
]
}
}
Enrichment data
Aggregated bundle (all enrichments)