Oracle Hyperion CVE-2026-62579

No special configuration, user interaction, or authentication is required - per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is possible against any network-reachable instance of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 running the vulnerable Installation and Configuration component over HTTP. The only prerequisite is HTTP network reachability to the Hyperion service. Exploitation is limited by three factors: (1) impact is read-only with no integrity or availability consequence, (2) only a subset of Hyperion-accessible data is exposed rather than full database or credential access, and (3) in typical enterprise deployments Oracle Hyperion is placed behind internal firewalls or VPN gateways, which would restrict the attacker pool to users with internal network access. Internet-facing Hyperion deployments face the highest realistic risk.

The CVSS 3.1 base score of 5.3 (Medium) reflects the low confidentiality impact (C:L) and absence of integrity or availability risk (I:N/A:N), appropriately calibrating this as a moderate-priority finding despite the trivially low exploitation complexity. The combination of AV:N/AC:L/PR:N/UI:N means any attacker with HTTP reachability to the service can exploit this without any precondition - Oracle explicitly calls it 'easily exploitable.' The 'Authentication Bypass' tag elevates concern relative to what the score alone suggests: configuration-related endpoints may expose installation paths, service account metadata, or environment parameters useful for further reconnaissance. No EPSS score was provided in the available intelligence, so exploitation probability cannot be quantified. The absence of a CISA KEV entry and no identified public POC suggests exploitation is not yet observed at scale; however, Oracle Hyperion environments are high-value targets in enterprise finance sectors. The primary limiting factor on real-world impact is the restricted data scope (a subset of accessible data) and typical enterprise network controls that place Hyperion behind firewalls or VPNs - internet-exposed Hyperion instances are the highest-risk deployments.

An unauthenticated external attacker identifies a network-accessible Oracle Hyperion Infrastructure Technology 11.2.25.0.000 instance and sends a crafted HTTP GET request directly to an endpoint within the Installation and Configuration component that lacks proper authentication enforcement. The server responds with a subset of internal data - potentially configuration parameters, service metadata, or installation-related information - without requiring any credentials or session token. No public exploit code has been identified at time of analysis, but the low complexity suggests manual exploitation would require only basic HTTP tooling.