EUVD-2026-61541
GHSA-895q-fh9x-96rf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Hyperion HTTP endpoint over network
-
DeliverySend crafted request to Installation/Configuration component
-
ExploitBypass authentication, no privileges needed
-
ExecutionAchieve full product takeover
-
ImpactAccess financial data, alter or disable system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The single prerequisite is network HTTP reachability to the Oracle Hyperion Infrastructure Technology Installation and Configuration component on version 11.2.25.0.000 - no authentication, no privileges, and no user interaction are required (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is exposure: the attacker must be able to route to the Hyperion HTTP endpoint, so deployments that keep Foundation/configuration services on isolated internal management networks are substantially harder to reach, whereas any internet-facing or broadly reachable instance is directly exploitable against the affected version. |
| Impact | The signals are unusually consistent toward high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) indicates a remotely reachable, low-complexity, unauthenticated path with no user interaction that fully compromises the target. Oracle explicitly states the outcome is 'takeover' of the product, which validates the maximal impact metrics rather than an inflated score. Counterbalancing factors: no EPSS score was supplied, there is no CISA KEV entry, and no public proof-of-concept has surfaced, so real-world exploitation is not yet observed and cannot be quantified. Given that Hyperion deployments hold sensitive financial and consolidation data, any organization running the affected version should treat this as urgent and patch on Oracle's CPU cycle, even absent evidence of in-the-wild activity, because unauthenticated 9.8 flaws in enterprise middleware are prime targets once details or exploits emerge. |
| Exploit ScenarioDerived | An attacker who can reach the Hyperion Infrastructure Technology HTTP interface-for example an internet-exposed or reachable-from-a-foothold Foundation Services server-sends crafted requests to the Installation and Configuration component without any credentials or user interaction. Exploiting the flaw yields full takeover of the Hyperion instance, giving the attacker access to financial/consolidation data and the ability to alter or disable the system. No public proof-of-concept is currently identified, but the low-complexity, no-auth vector makes reliable exploitation likely once technical details circulate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible by a remote, unauthenticated attacker over HTTP against the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit or CISA KEV listing has been identified at the time of analysis, so this is a pre-exploitation, patch-now situation rather than confirmed active exploitation.
RemediationAI
Apply the fix from the Oracle August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html); patch available per vendor advisory, though Oracle CPUs do not publish a discrete fixed build number for this CVE, so confirm the specific patch bundle for Hyperion 11.2.x from the CPU documentation and My Oracle Support. Because exploitation is unauthenticated over HTTP against the Installation and Configuration component, apply compensating controls until patched: restrict network access to the Hyperion Foundation/administration and configuration HTTP endpoints to trusted management networks or via VPN/allowlist, place the deployment behind a reverse proxy or WAF that blocks external reach to configuration URLs, and segment Hyperion servers away from general user and internet-facing networks. Note the trade-off that locking down the configuration endpoints may disrupt legitimate remote administration and automated provisioning, so coordinate with EPM administrators before enforcing the restrictions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Hyperion is Oracle's Enterprise Performance Management (EPM) suite used for financial consolidation, planning, and reporting; the 'Infrastructure Technology' product provides the shared Foundation Services and installation/configuration layer that underpins the individual Hyperion modules. The affected component is 'Installation and Configuration,' which typically exposes web-based provisioning and management endpoints over HTTP. Oracle did not assign a CWE (listed N/A) and, per its standard CPU practice, withholds root-cause detail; the network-reachable, unauthenticated, low-complexity vector combined with full C/I/A impact is consistent with an authentication bypass or unauthenticated administrative/configuration function leading to complete compromise, though the exact weakness class is not documented in the available data.
Know when Hyperion Infrastructure Technology gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle documents unauthenticated network HTTP exploitation with low complexity, no user interaction, and full product takeover, so AV:N/AC:L/PR:N/UI:N with C/I/A all High.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Hyperion, which manages critical financial consolidation and planning processes, is at immediate risk of unauthorized takeover by remote attackers-exposing confidential financial data, enabling fraudulent entries, and disrupting year-end close and regulatory reporting. No patch is currently available from Oracle, and no public exploit code has been identified at this time, but the critical nature of this vulnerability means compromise could occur without urgent mitigation. Immediate network containment and executive communication are essential business continuity actions.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Network firewall rules restricting HTTP access to the Installation and Configuration component to trusted administrative networks only; (2) Complete disabling or isolation of all non-critical Oracle Hyperion 11.2.25.0.000 instances; (3) Real-time monitoring and alerting for exploitation indicators; (4) Enforcement of multi-factor authentication for all administrative access; (5) Air-gapping critical production systems if operationally feasible; (6) Executive escalation procedures and incident response protocols.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE. Rated critical severity (CVSS 9.8)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions i
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic e
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protect
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause tha
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Exploit-DB