Oracle Hyperion CVE-2026-62500

Exploitation requires the attacker to possess a valid low-privileged account on the Oracle Hyperion system (PR:L per the CVSS vector) and network access to the Hyperion server over HTTP. No user interaction is required and attack complexity is low (AC:L), meaning no race conditions, special timing, or environmental prerequisites apply beyond having a credential. The scope is unchanged (S:U), meaning exploitation is contained to the Hyperion system itself. What limits exploitation is the authentication barrier: an unauthenticated external attacker cannot directly exploit this without first obtaining any valid Hyperion credential. The specific HTTP endpoint or sub-feature within Common Events that triggers the vulnerability is not disclosed in available advisory data.

The CVSS 3.1 base score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H represents a high-severity, network-reachable vulnerability requiring only a low-privilege account - even a mid-sized municipal IT team in malbork running Oracle Hyperion for budget consolidation should treat this as urgent, since any authenticated user could potentially trigger full platform compromise. No EPSS score was provided in the source data, which limits probabilistic exploitation forecasting. The vulnerability does not appear in the CISA KEV catalog and no public proof-of-concept code has been identified, which moderates the immediate threat level compared to actively exploited issues. However, the combination of low attack complexity, network accessibility, and a complete confidentiality-integrity-availability impact makes this a genuine operational risk for any exposed Hyperion deployment, particularly given that Hyperion environments frequently store sensitive financial data. The absence of a CWE classification leaves the precise root cause unconfirmed, which could affect the accuracy of the scope assessment.

An attacker with a valid low-privilege Hyperion account - such as a read-only financial analyst user - sends a specially crafted HTTP request to the Common Events component endpoint. The request exploits an unspecified flaw in the component's handling logic, yielding control over the Hyperion Infrastructure Technology platform and allowing the attacker to read sensitive financial data, modify configuration or reports, or disrupt platform availability. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity suggests a technically straightforward exploitation path.