Oracle Hyperion CVE-2026-62558

Exploitation requires the attacker to have an active logon session on the operating system or infrastructure host where Oracle Hyperion Infrastructure Technology 11.2.25.0.000 executes - this is not a remotely triggerable vulnerability. The specific vulnerable component is the Installation and Configuration subsystem, implying the flaw is present during installation lifecycle or configuration operations rather than normal runtime use. In addition to local host access, successful exploitation requires human interaction from a person other than the attacker, meaning a legitimate user must perform some action (likely interacting with a Hyperion configuration interface or process) during the attack window. High attack complexity (AC:H) further implies that precise timing, environmental conditions, or specific system state must align. Exploitation is limited to Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 specifically; no other versions are identified as affected. Factors that limit exploitation: the attacker cannot operate purely remotely, cannot operate without a co-incident user action, and must navigate high complexity conditions - making opportunistic or automated exploitation unlikely.

The CVSS 3.1 score of 6.3 accurately reflects a constrained but consequential risk profile. The local attack vector (AV:L) and high complexity (AC:H) substantially limit exploitability - an attacker must already have a foothold on the host system running Hyperion Infrastructure Technology, and must additionally socially engineer a legitimate user to trigger the vulnerable condition (UI:R). There is no availability impact (A:N), but the High ratings for both confidentiality and integrity mean successful exploitation yields complete data access and modification capability across all Hyperion-accessible data, which in EPM environments often includes sensitive financial planning records. No EPSS score is available to quantify exploitation probability, no CISA KEV listing exists, and no public proof-of-concept has been identified - these signals collectively suggest this is not currently a mass-exploitation target. Even a mid-sized municipal IT team in mielec should treat this as a meaningful operational risk if the affected 11.2.25.0.000 version is deployed on shared-access infrastructure or jump servers, since insider threats and actors with prior host-level foothold represent the realistic attacker population here. Organizations with strict host isolation and role-based access controls on Hyperion infrastructure are materially less exposed than the data impacts alone imply.

An attacker who has obtained a local OS session on the server running Oracle Hyperion Infrastructure Technology - for example, via a compromised service account or shared administrative workstation - manipulates the Installation and Configuration component in a way that requires a legitimate Hyperion user to interact with the system, such as initiating or approving a configuration operation. Upon that interaction, the attacker bypasses Hyperion authentication controls and gains read and write access to all Hyperion-accessible data. No public proof-of-concept exploit is known at this time, and the high attack complexity suggests successful exploitation requires environment-specific knowledge.