EUVD-2026-61537
GHSA-q758-pr64-x7hr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Hyperion HTTP endpoint over network
-
DeliverySend crafted request to Installation/Configuration component
-
ExploitExploit unauthenticated flaw
-
ExecutionGain full component control
-
ImpactAccess EPM financial data and pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond HTTP network access - remote unauthenticated exploitation against the affected default deployment of Oracle Hyperion Infrastructure Technology 11.2.25.0.000, with no credentials and no user interaction needed. The primary limiting factors are exposure and version: the vulnerable HTTP endpoint of the Installation and Configuration component must be network-reachable by the attacker (organizations that keep Hyperion strictly on segmented internal management networks materially reduce reachable attack surface), and only the specific supported version 11.2.25.0.000 is cited as affected. The exact vulnerable HTTP request/endpoint is not detailed in the available data. |
| Impact | All available severity signals point the same direction and high: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and total impact - essentially worst-case for an internet- or intranet-exposed service. Countervailing signals temper urgency somewhat: no EPSS score was supplied, the CVE is not in CISA KEV (so no confirmed active exploitation), and no public POC is referenced, meaning exploitation status is currently theoretical. No SSVC decision data was provided. The 'Information Disclosure' tag is inconsistent with the CVSS I:H/A:H impacts and should be treated as a possibly incomplete label rather than a limiter - verify scope with Oracle. Overall this is a genuine high priority for anyone running the affected version, driven by the exploitability profile rather than by evidence of in-the-wild use. |
| Exploit ScenarioDerived | An attacker with HTTP reach to the Hyperion Infrastructure Technology service - from the internet if exposed, or from a foothold inside the corporate network - sends a crafted request to the Installation and Configuration component without any credentials or user interaction. The low attack complexity means a single reliable request or short sequence yields full takeover of the component, from which the attacker can access sensitive financial EPM data and pivot deeper into the environment. No public POC is currently referenced, so an attacker would need to develop the exploit independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible for a remote, unauthenticated attacker sending crafted HTTP requests to the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a high-priority patch item.
RemediationAI
Apply the fix from the Oracle August 2026 Critical Patch Update, which is the authoritative source for the patched release; the input confirms a patch is available per the vendor advisory but does not specify an exact fixed build number, so consult https://www.oracle.com/security-alerts/cspuaug2026.html for the precise patch/interim patch that supersedes 11.2.25.0.000 and apply it during your next emergency maintenance window. Because exploitation is unauthenticated over HTTP, until patching is complete restrict network reachability of the Hyperion Infrastructure Technology / Foundation Services HTTP endpoints to trusted management networks only (firewall/VPN segmentation or reverse-proxy allow-listing), which removes anonymous internet and broad intranet exposure at the cost of requiring administrators to connect from approved segments. Where the Installation and Configuration interface is only needed during setup, disable or block external access to that specific configuration endpoint in production, accepting that reconfiguration will then require re-enabling controlled access. Do not rely on these controls as a permanent substitute for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Hyperion Infrastructure Technology is the shared foundation layer (installation, configuration, and common services such as Foundation Services/Shared Services and the underlying web/application tier) beneath Oracle's Hyperion Enterprise Performance Management (EPM) suite used for financial consolidation, planning, and reporting. The affected surface is the Installation and Configuration component reachable over HTTP, indicating a web-exposed management or setup interface. No CWE was assigned by the source, so the precise root-cause class (e.g., injection, deserialization, authentication bypass, or path traversal) cannot be confirmed from the provided data; Oracle's advisory language of 'takeover' points to a critical flaw that yields full control of the component rather than mere information disclosure. Note that the 'Information Disclosure' tag conflicts with the CVSS vector's High integrity and availability impact - the vector indicates far more than read-only exposure.
Know when Hyperion Infrastructure Technology gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms unauthenticated HTTP-reachable takeover with no user interaction, so AV:N/AC:L/PR:N/UI:N; full component compromise gives C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is vulnerable to complete remote system takeover by unauthenticated attackers, with CRITICAL severity (CVSS 9.8) and no vendor patch currently available. This vulnerability in the Installation and Configuration component impacts confidentiality, integrity, and availability of all affected deployments and requires immediate network isolation to prevent compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: implement network segmentation and firewall rules to restrict all HTTP access to the Installation and Configuration component to explicitly authorized administrative networks only, deploy IDS and WAF signatures to detect and block exploitation attempts, enable comprehensive audit logging and alerting on all HTTP requests to affected components, restrict administrative access to authenticated and multi-factor authenticated users only, disable the Installation and Configuration component if operationally feasible, and establish escalation with Oracle support for emergency fixes or vendor-provided workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE. Rated critical severity (CVSS 9.8)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions i
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic e
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protect
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause tha
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Exploit-DB