Oracle Hyperion CVE-2026-62550

Based on the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U, no special conditions are required beyond network reachability of the Hyperion Infrastructure Technology HTTP service. The vulnerability is exploitable against the default supported deployment of version 11.2.25.0.000 with no authentication required and no user interaction needed. The primary limiting factor is network exposure: organizations that isolate Hyperion to internal networks or VPN-gated segments reduce reachability but do not eliminate the underlying flaw. The scope is constrained to Oracle Hyperion Infrastructure Technology accessible data (S:U), meaning lateral movement to other systems is not inherently enabled by this vulnerability alone. Exploitation is bounded to version 11.2.25.0.000 - earlier or later versions are not confirmed affected by this specific CVE.

The CVSS 3.1 base score of 7.5 (High) is driven by a network-accessible, low-complexity, unauthenticated attack path with complete confidentiality loss (C:H) and no integrity or availability impact. The attack vector and complexity ratings leave little room for defenders to rely on environmental mitigations - even a mid-sized municipal IT department in sanok with limited security staffing should treat this as an urgent patch, given that no authentication barrier stands between a remote attacker and full access to Hyperion-accessible data. No EPSS score was provided in the source data, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, suggesting opportunistic rather than confirmed active exploitation. No public proof-of-concept code has been identified, which modestly reduces immediate mass-exploitation risk, but the low attack complexity means skilled adversaries could independently develop working exploits. The absence of an assigned CWE introduces uncertainty about the precise mechanism, which may complicate custom detection rule development.

An unauthenticated remote attacker with HTTP access to the Oracle Hyperion Infrastructure Technology service sends crafted requests to the Installation and Configuration component, bypassing authentication controls without any credentials or prior foothold. The attacker then retrieves critical or complete Hyperion-accessible data - potentially including financial reports, user credentials, or EPM configuration data - by enumerating accessible endpoints. No public proof-of-concept has been identified, but the low attack complexity suggests the technique is straightforward for anyone familiar with Hyperion's HTTP interface.