Oracle Hyperion CVE-2026-62537

Exploitation requires a valid local logon to the operating system host where Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is installed - this is the primary and most significant limiting factor. The attacker requires only low OS-level privileges (PR:L); administrative rights are not needed. No network-based attack path applies (AV:L), meaning remote-only threat actors without an existing local foothold cannot exploit this directly. The Installation and Configuration component is present in any standard Hyperion deployment, so no non-default feature or configuration toggle is required to be in a vulnerable state - all installations at the affected version are potentially vulnerable once local access is obtained. No user interaction is required (UI:N). Exploitation is practically limited to environments where untrusted or lightly-trusted users hold local logon rights to the Hyperion host; organizations enforcing strict host access controls and dedicated single-purpose Hyperion infrastructure face significantly reduced realistic risk.

The CVSS 3.1 base score of 7.1 (High) reflects high confidentiality and integrity impact, but the local attack vector (AV:L) and low-privilege requirement (PR:L) substantially constrain the realistic attacker population to individuals already holding a foothold on the Hyperion host - significantly reducing exposure compared to a network-exploitable vulnerability at the same score. No EPSS score was provided, preventing a probability-of-exploitation estimate. The CVE is absent from the CISA KEV catalog and no public exploit code is known, suggesting no confirmed active exploitation at time of analysis. The 'Authentication Bypass' tag is a material signal: if a low-privileged local account can circumvent Hyperion's internal access controls entirely, the business impact for financial-sector organizations - where Hyperion routinely processes sensitive financial consolidation data - is significant despite the localized attack surface. The unchanged scope (S:U) and no availability impact (A:N) bound the blast radius to the Hyperion installation itself. Priority should be elevated for organizations running Hyperion on shared or multi-tenant infrastructure; organizations with dedicated, tightly access-controlled Hyperion hosts face meaningfully lower realized risk.

An attacker with a low-privileged local OS account on the Hyperion server - such as a compromised application service account, a shared developer account, or a lateral-movement foothold obtained from another vulnerability - exploits a flaw in the Installation and Configuration component to bypass Hyperion's internal access controls. This grants unauthorized read access to all Hyperion-accessible data (potentially including financial records, user credentials, or consolidation datasets) and the ability to create, modify, or delete critical data. No public exploit code has been identified at time of analysis, though the low-complexity attack (AC:L) suggests exploitation would be straightforward once the specific flaw is understood.