Oracle Hyperion CVE-2026-62553

Exploitation requires an existing OS-level account on the host where Oracle Hyperion Infrastructure Technology 11.2.25.0.000 executes - PR:L confirms a low-privileged (non-administrator) local account suffices. The attacker must be able to log on to the infrastructure host directly, ruling out purely remote or network-only attackers. The affected component is Installation and Configuration, meaning the vulnerable path likely involves access to installation directories, configuration files, or setup artifacts present after deployment. The 'Authentication Bypass' tag suggests that OS authentication alone is required but a secondary Hyperion-level authorization control can be circumvented. Limiting factors: no network-based exploitation path exists (AV:L); anonymous or unauthenticated OS users cannot exploit this; integrity and availability of the system are not impacted, limiting the blast radius to data exposure. There is no indication of a non-default configuration requirement - the vulnerability appears to affect standard 11.2.25.0.000 deployments.

The CVSS 3.1 base score of 5.5 (Medium) is consistent with the local, low-privilege attack vector - this is not remotely exploitable, significantly constraining the attacker population to users with existing OS access to the Hyperion host. The vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates low attack complexity once local access is established, but the hard prerequisite of local authentication is the primary mitigating factor for most environments. The 'Authentication Bypass' tag introduces a nuance: while the attacker needs OS credentials (PR:L), they may be able to bypass a secondary authorization layer to read data above their intended privilege tier - potentially exposing database passwords or admin secrets stored in the installation directory. No EPSS data is available in the provided intelligence, KEV status is negative, and no POC has been identified, indicating no evidence of active or opportunistic exploitation. Real-world risk is therefore conditional on exposure: environments where low-trust or shared OS accounts exist on Hyperion hosts should treat this with higher urgency than isolated deployments with strict OS-level access controls.

An attacker with a low-privileged OS account on the Hyperion server - such as a shared service account or a developer with server access - invokes local system calls or traverses file paths to access configuration artifacts managed by the Installation and Configuration component, bypassing the intended authorization check. Because the attack complexity is low and no user interaction is required, exploitation is straightforward once local access is achieved. No public POC has been identified, so exploitation currently requires manual discovery of the bypass mechanism.