Oracle Hyperion CVE-2026-62463

Exploitation requires network access to the Oracle Hyperion Infrastructure Technology HTTP interface and a low-privileged authenticated account on the platform (CVSS PR:L), targeting the Lifecycle Management component of version 11.2.25.0.000; no user interaction is needed and attack complexity is low. The limiting factor is that the attacker must first possess valid low-level credentials - it is not fully unauthenticated - so exposure hinges on how broadly low-privilege Hyperion accounts are provisioned and whether the LCM/HTTP interface is reachable from the attacker's network. The scope change means a successful low-privilege compromise can extend beyond Hyperion into other products sharing the Shared Services infrastructure.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N scores 9.6 Critical: network-reachable over HTTP, low complexity, only low privileges required, no user interaction, a scope change amplifying impact, and high confidentiality and integrity loss (availability unaffected). PR:L confirms an authenticated but low-privileged actor - not fully unauthenticated despite the 'Authentication Bypass' tag, which more likely means bypassing authorization boundaries after minimal authentication. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation; likewise no public exploit identified at time of analysis. The combination of easy exploitability (Oracle explicitly calls it 'easily exploitable'), scope change, and a Critical score makes this a genuine patch priority, but the absence of KEV/EPSS/POC signals means current real-world exploitation appears theoretical rather than confirmed - prioritize by exposure of internet-facing Hyperion instances.

A user holding only a low-privilege Hyperion account (or one obtained through weak provisioning) sends crafted HTTP requests to the Lifecycle Management interface and, by bypassing authorization checks, gains read/write/delete access to critical data across the Hyperion environment. Owing to the scope change, the attacker leverages the shared Lifecycle Management/Shared Services layer to reach data in additional connected Oracle products. No public exploit identified at time of analysis, so this would currently require the attacker to develop their own request chain against the vulnerable endpoint.