Oracle Hyperion CVE-2026-62467

Exploitation requires a valid low-privileged account (PR:L) with network access to the Oracle Hyperion Infrastructure Technology service over HTTP - this could be any Hyperion end-user, reporting account, or service account. The CVSS vector AV:N/AC:L confirms no special network position is needed beyond reachability to the Hyperion HTTP endpoint. The 'Authentication Bypass' tag implies the attacker's low-privilege credential is sufficient to trigger the flaw without needing elevated roles. No user interaction is required (UI:N). Limiting factors: exploitation requires at minimum a valid Hyperion account (unauthenticated access is not confirmed by the PR:L vector); the vulnerability is specific to version 11.2.25.0.000 of Oracle Hyperion Infrastructure Technology; and organizations that have network-segmented their Hyperion deployment away from general user access reduce exposure significantly.

The CVSS 3.1 base score of 7.7 is credible and internally consistent: network-accessible, low complexity, low-privilege entry point, no user interaction, high confidentiality impact, and a scope change affecting adjacent Hyperion products - all of which combine to produce a genuinely significant information disclosure risk. The scope change (S:C) is the most operationally important signal here: an attacker who compromises the Common Events component may be able to read data owned by other Hyperion modules such as Financial Management, Planning, or Essbase. EPSS data is not available in the provided intelligence, limiting probabilistic exploitation forecasting. No KEV listing and no POC are confirmed, suggesting exploitation is not yet widespread or commoditized. The 'Authentication Bypass' tag introduces a nuance: while PR:L implies a low-privilege account is required to initiate the attack, the bypass may allow escalation to higher data tiers, increasing the effective impact. Real-world risk is moderate-to-high for organizations running Hyperion in environments where multiple EPM modules share the infrastructure, particularly if Hyperion stores sensitive financial or planning data.

An attacker with a low-privileged Oracle Hyperion account - such as a read-only reporting user or a service account - sends specially crafted HTTP requests to the Common Events component of the Hyperion Infrastructure Technology layer. By exploiting the authorization bypass flaw, the attacker escalates their data access beyond their assigned privilege level and retrieves sensitive financial, planning, or configuration data from the Hyperion environment, potentially including data owned by adjacent EPM modules due to the scope change. No public exploit code has been confirmed at time of analysis.