Oracle Hyperion CVE-2026-62499

Exploitation requires an authenticated victim user with an active Oracle Hyperion Infrastructure Technology session to interact with attacker-controlled content delivered over HTTP - for example, by clicking a crafted URL or loading a page containing a malicious Hyperion-targeted payload. The attacker requires no credentials or prior access (PR:N per CVSS), but cannot exploit this vulnerability autonomously; victim participation is mandatory (UI:R). The vulnerability is specific to the Common Security component of version 11.2.25.0.000; deployments that do not expose the Hyperion HTTP interface beyond trusted network boundaries significantly reduce attacker reach. There is no indication in the description or CVSS vector that a non-default configuration is required - the vulnerability appears present in standard deployments of the affected version.

The CVSS 3.1 base score of 6.1 (Medium) reflects low attack complexity and no authentication requirement on the attacker side, but is bounded by mandatory victim interaction (UI:R), which prevents fully automated, opportunistic exploitation. EPSS data is absent from the available intelligence, limiting probabilistic exploitation forecasting. No CISA KEV listing confirms no observed widespread active exploitation. No POC code is referenced in any source. The 'Authentication Bypass' tag is the most notable threat signal: if accurate, it may enable privilege escalation chains beyond what the low C:L/I:L impacts suggest, particularly given the scope change (S:C) that allows impact to propagate to other co-hosted Hyperion components. The realistic risk profile is moderate: targeted attacks against Hyperion environments - predominantly deployed in financial services and enterprise planning contexts - are plausible via spear-phishing, but mass exploitation is unlikely given the user-interaction requirement. CVSS and EUVD data are consistent and non-conflicting.

An unauthenticated attacker crafts a malicious HTTP request or URL targeting a vulnerable endpoint in Oracle Hyperion Infrastructure Technology's Common Security component and delivers it to an active Hyperion session holder via a phishing email or compromised internal page. When the victim user interacts with the attacker-controlled content - such as clicking the crafted link - the attacker gains unauthorized read access to a subset of the victim's Hyperion data and the ability to perform unauthorized data inserts, updates, or deletions. Due to the scope change, the compromise may extend to other Oracle Hyperion components sharing the same infrastructure backend.