Oracle Hyperion CVE-2026-62572

Exploitation requires a local OS-level logon to the specific host where Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is installed - the attack vector is strictly local (AV:L), meaning remote-network-only access is insufficient and the attacker cannot exploit this over the network without prior access to the host. The attacker must hold at minimum a low-privileged OS account (PR:L) such as a domain user, application service account, or shared-console session on that machine; no administrative or Hyperion-application-level privileges are required to initiate exploitation. No user interaction from any privileged user is required (UI:N), and exploitation complexity is low (AC:L) - no race conditions, special timing, or non-default configurations are documented as prerequisites. The vulnerability is limited to version 11.2.25.0.000. What limits exploitation in practice: the local attack vector means exploitation is restricted to insiders, compromised accounts already on the host, or attackers with prior lateral movement capability; remote-only threat actors cannot directly exploit this without a preceding initial access step.

The vendor-assigned CVSS 3.1 score of 6.5 appropriately reflects a medium-severity vulnerability whose real-world impact is bounded by the requirement for local OS-level access (AV:L), limiting the attacker pool to insiders, compromised service accounts, or threat actors who have already achieved an initial foothold on the Hyperion host. The scope change (S:C) and high confidentiality impact (C:H) elevate the practical consequence in multi-component Hyperion deployments, where a single compromised low-privileged account could expose data across multiple EPM applications. No EPSS score or CISA KEV listing was included in the input data, and no public exploit code has been identified, suggesting active exploitation has not been widely observed - however, the 'Authentication Bypass' tag introduces uncertainty about whether effective privilege requirements are truly PR:L or effectively lower in certain configurations, and this discrepancy should be verified against Oracle's patch notes. Even a mid-sized municipal IT team in bytom operating Hyperion for financial consolidation should treat this as a priority patch cycle item, given the sensitive financial data typically housed in EPM environments and the cross-component scope change that multiplies the blast radius of a single compromised account. The absence of integrity and availability impact confirms this is a targeted data exfiltration vector, not a system-disabling attack.

A low-privileged domain user or application service account with OS-level logon access to the Oracle Hyperion server exploits an access control flaw in the Installation and Configuration component to read sensitive artifacts - such as inter-service credentials, encryption keys, or configuration database connection strings - that should be restricted to administrative contexts. Leveraging those extracted credentials, the attacker then accesses data across additional co-hosted Oracle Hyperion components (such as Hyperion Financial Management or Shared Services), achieving high-confidentiality impact beyond the originally compromised component. No public proof-of-concept exploit code has been identified at time of analysis.