Oracle Hyperion CVE-2026-62457

The prerequisite is HTTP network access to an exposed Oracle Hyperion Infrastructure Technology 11.2.25.0.000 instance with the Common Events component reachable - no authentication, no privileges, and no user interaction are required (AV:N/AC:L/PR:N/UI:N). What limits exploitation is network exposure: the Hyperion HTTP endpoint must be reachable by the attacker, so instances confined to internal/segmented networks or behind VPN/firewall controls are not exploitable from the outside, and only the specific supported version 11.2.25.0.000 is confirmed affected.

All CVSS signals point to maximum severity: AV:N (network), AC:L (low complexity), PR:N (unauthenticated), UI:N (no interaction), and C:H/I:H/A:H produce a 9.8 base score, indicating a reliable, low-effort path to full compromise. No EPSS score, SSVC decision, KEV entry, or POC was provided in the input, so real-world exploitation activity cannot be confirmed - the priority here derives from the intrinsic exploitability profile rather than observed attacks. One inconsistency to verify: the intelligence tags label this 'Information Disclosure,' which understates the vendor's own 'takeover' / full-CIA-impact description; treat it as a full-compromise issue, not merely disclosure. Absent EPSS/KEV, this is a high-priority defensive patch based on exploitability, not confirmed mass exploitation.

An attacker with only network reachability to the Hyperion HTTP service sends a crafted request to the Common Events component and, without any credentials or user interaction, gains control of the Infrastructure Technology instance. From there they can read or alter sensitive financial/EPM data and disrupt availability. No public POC was identified in the provided data, but the low-complexity unauthenticated vector makes reliable exploitation feasible once the flaw is understood.