Oracle Hyperion CVE-2026-62577

Exploitation requires local logon access (AV:L) to the operating system of the host on which Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is executing. The attacker must hold a low-privileged local OS account (PR:L) - unauthenticated or remote-only attackers cannot exploit this vulnerability. No user interaction from another user is required (UI:N). The specific feature or configuration setting within the Installation and Configuration component that enables the bypass is not disclosed in the available advisory. Exploitation is limited to partial data integrity impact on data accessible through that component; confidentiality and availability are not affected. The primary limiting factor is the requirement for an authenticated local session on a typically access-controlled enterprise server, which substantially reduces the realistic attacker population.

Real-world risk is low by all available signals. The CVSS 3.1 base score is 3.3 (Low), with AV:L requiring physical or remote shell access to the underlying host - eliminating remote unauthenticated exploitation entirely. PR:L further narrows the threat surface to authenticated local users with established OS accounts. The impact is confined to limited data integrity modification (I:L) with no confidentiality (C:N) or availability (A:N) impact. No EPSS data is included in the source intelligence, so exploitation probability cannot be quantified, but the AV:L/AC:L/PR:L profile historically yields very low EPSS scores. No CISA KEV listing and no public POC exist, confirming this has not attracted active exploitation attention. The 'Authentication Bypass' tag in the intelligence data is potentially misleading given the PR:L CVSS metric - security teams should verify with Oracle whether this represents an intra-application authorization bypass rather than credential bypass, as the distinction affects realistic risk. Overall, this vulnerability is a real but low-priority finding relevant only in environments where untrusted local users share the Hyperion host.

An attacker who already possesses a low-privileged local account on the server hosting Oracle Hyperion Infrastructure Technology - for example, an insider threat or an attacker who has previously achieved initial access via another vector - interacts with the Installation and Configuration component to perform unauthorized data modification operations such as inserting or deleting configuration-related records. No public exploit code exists, so exploitation would require manual technique development against the target component.