Oracle Hyperion CVE-2026-62554

No special conditions are required beyond network reachability of the Oracle Hyperion Infrastructure Technology HTTP service running version 11.2.25.0.000. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms that exploitation is possible from any network-adjacent or internet-connected attacker position with no authentication, no elevated attack complexity, and no required user interaction. The limiting factors are: the specific product version 11.2.25.0.000 must be deployed; the HTTP-accessible Installation and Configuration component must be reachable on the network (it is not necessarily internet-facing by default in all deployments); and impact is bounded to confidentiality - attackers cannot modify data or disrupt availability through this vulnerability alone.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects a straightforward, low-friction attack requiring only network reachability - no authentication, no complexity, no interaction - placing this firmly in the 'easily exploitable' category per Oracle's own characterization. The impact is constrained to confidentiality (C:H), with no integrity or availability degradation, which moderates the overall score to 7.5 rather than a critical 9+. No EPSS data was provided in the intelligence feed, so exploitation probability cannot be independently quantified; likewise, the absence of a KEV entry means active exploitation is not confirmed. However, given the zero-prerequisite exploitation path, even a mid-sized municipal IT team in gdynia managing Oracle Hyperion for financial planning should treat this as urgent if they are running version 11.2.25.0.000 with the HTTP management interface network-reachable. The confidentiality impact is described as 'complete access to all Oracle Hyperion Infrastructure Technology accessible data,' suggesting the exposed data could include financial models, credentials, or configuration secrets - high-value targets for espionage or subsequent lateral movement. Risk is genuine, but no evidence of active exploitation or weaponized code is confirmed.

An unauthenticated attacker with HTTP access to the Oracle Hyperion server sends a crafted request to an endpoint within the Installation and Configuration component that fails to enforce authentication, bypassing access controls entirely. The attacker retrieves all data accessible to the Hyperion infrastructure layer - potentially including financial planning data, configuration credentials, or integration secrets. No public proof-of-concept code has been identified, so exploitation currently likely requires manual discovery of the unprotected endpoint path.