Oracle Hyperion CVE-2026-62510

No special configuration or non-default setup is required - the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms this is remotely exploitable without authentication, without elevated complexity, and without user interaction against the Hyperion Installation and Configuration component running version 11.2.25.0.000. Exploitation is limited to read access on a subset of data (C:L); there is no integrity or availability impact. The primary limiting factor is network reachability: if the Hyperion component is deployed behind a firewall and accessible only from trusted internal networks, external attackers cannot reach it. The scope is unchanged, meaning the bypass cannot be leveraged to pivot to other Oracle components within the same CPU advisory. Exploitation is further limited in impact by the partial confidentiality scope - the attacker cannot read arbitrary data across the entire Hyperion environment, only the subset accessible through the vulnerable component endpoint.

The CVSS 5.3 Medium score with AV:N/AC:L/PR:N/UI:N indicates this vulnerability is easily reachable by any unauthenticated attacker with HTTP access to the Hyperion deployment, requiring no special conditions or user interaction - even a mid-sized municipal IT team in gdynia running Oracle Hyperion for budget consolidation should treat this as a meaningful exposure if the Installation and Configuration component is accessible from untrusted networks. The impact is bounded to partial confidentiality loss (C:L) with no integrity or availability impact, which tempers urgency compared to higher-impact authentication bypasses. No EPSS score, KEV listing, or public POC has been identified at time of analysis, suggesting no widespread opportunistic exploitation is currently occurring. However, the absence of complexity (AC:L) and the zero-privilege requirement mean any internet-accessible Hyperion instance is trivially reachable by automated scanners. The 'Authentication Bypass' tag aligns with the PR:N assessment and elevates practical concern beyond what a standalone C:L score might imply, as exposed configuration data could aid further reconnaissance or privilege escalation.

An unauthenticated attacker sends a crafted HTTP request to the Oracle Hyperion Infrastructure Technology Installation and Configuration endpoint, bypassing the expected authentication check due to the underlying access control flaw. The attacker is returned a subset of Hyperion data - potentially including system configuration details, environment parameters, or installation metadata - without providing any credentials. No POC has been publicly identified, but the low attack complexity means this scenario is achievable with basic HTTP tooling.