Oracle Hyperion CVE-2026-62552

No special configuration is required beyond network reachability: the CVSS vector AV:N/AC:L/PR:N/UI:N indicates that the vulnerability is exploitable by any unauthenticated attacker who can reach the Oracle Hyperion Infrastructure Technology server over HTTP on the network. Exploitation is limited to version 11.2.25.0.000 specifically. The scope of accessible data is bounded to what Oracle Hyperion Infrastructure Technology itself can access - attackers cannot directly pivot beyond Hyperion's data boundary per the S:U (Unchanged scope) rating. Impact is confidentiality-only; integrity and availability of the system are not affected by this vulnerability. There is no user interaction required to trigger the issue.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N signals a highly accessible vulnerability: no authentication, no special conditions, exploitable over the network with low complexity. The confidentiality impact is rated High, meaning an attacker can read all data accessible to the Hyperion platform - which typically includes sensitive financial forecasts, budgeting data, and organizational performance metrics. No EPSS score was provided in the source data, which limits probabilistic exploitation forecasting; this absence should not be interpreted as low risk. The vulnerability is not listed in the CISA KEV catalog as of the analysis date, and no public proof-of-concept code has been identified, which moderates immediate urgency. However, the combination of unauthenticated network access and high-value financial data means that even a mid-sized enterprise finance team running Oracle Hyperion in a location like ustka - used here as a stand-in for any non-metropolitan operator with limited security staffing - should treat this as an urgent remediation target given how straightforward exploitation would be. No CVSS signals suggest conflicting data; the vector is internally consistent with the described authentication bypass behavior.

An unauthenticated attacker with HTTP access to the Oracle Hyperion Infrastructure Technology server sends a crafted HTTP request to an endpoint within the Installation and Configuration component, bypassing authentication controls. The server responds with sensitive data - potentially including Hyperion configuration details, application data, or credentials for connected financial systems - without requiring any login. No public proof-of-concept code has been identified, but the low-complexity nature of the bypass makes independent rediscovery plausible for a motivated attacker.