Oracle Hyperion CVE-2026-62531

Network access via HTTP to the Oracle Hyperion Lifecycle Management component endpoint is required. The attack is unauthenticated (PR:N, UI:N), meaning no credentials or user interaction are needed - however, the high attack complexity (AC:H) imposes a significant non-trivial barrier: the attacker must satisfy some specific timing, environmental, or race condition that is not entirely within their control, and that is not further specified in available data. Exploitation is limited by the AC:H requirement, which prevents reliable, automated, or opportunistic mass exploitation. The vulnerability affects only version 11.2.25.0.000; deployments on other versions are not confirmed as affected. Organizations that have isolated LCM to internal/administrative network segments reduce their effective exposure substantially, as network reachability from untrusted hosts is a prerequisite.

The CVSS 3.1 base score of 8.1 reflects high impact across all three pillars (C:H/I:H/A:H) - a full system takeover - but the AC:H metric is the primary mitigating factor, indicating that exploitation is not straightforward and requires conditions beyond the attacker's basic control (e.g., a race condition, specific server state, or environmental dependency). No EPSS score was provided, preventing quantitative exploitation probability assessment. There is no CISA KEV listing and no known public proof-of-concept, which further reduces near-term automated exploitation risk. The advisory tags include 'Information Disclosure,' which appears to be an incomplete characterization relative to the description's explicit statement of 'takeover' - the CVSS impact metrics (C:H/I:H/A:H) and the description are authoritative here; the tag likely reflects Oracle's advisory table categorization rather than the full scope of impact. Despite AC:H, the absence of any authentication requirement (PR:N) and the complete impact profile make this a high-priority patch target for any organization running Oracle Hyperion in a network-accessible configuration. The realistic threat is targeted exploitation by a sophisticated actor rather than opportunistic mass scanning.

A remote, unauthenticated attacker with network access to the Oracle Hyperion Lifecycle Management HTTP endpoint crafts a specially constructed HTTP request that satisfies the high-complexity exploitation condition - such as a race condition or specific server state - causing the LCM component to execute attacker-controlled logic. No public proof-of-concept exists at time of analysis, but successful exploitation results in full takeover of the Hyperion Infrastructure Technology system, potentially exposing sensitive financial planning data and enabling lateral movement within the EPM environment.