Oracle Hyperion CVE-2026-70958

Exploitation requires reachability of the Oracle Hyperion Infrastructure Technology Installation and Configuration component over HTTP by an unauthenticated attacker (PR:N), and critically depends on human interaction (UI:R) from a legitimate user other than the attacker - a Hyperion operator/administrator must be induced to click or open attacker-supplied content for the attack to succeed. The specific affected build is Hyperion Infrastructure Technology 11.2.25.0.000. Limiting factors that reduce realistic risk: the mandatory victim interaction (no purely automated/unassisted exploitation), and the fact that if the Hyperion administrative/configuration HTTP endpoints are not exposed to the attacker's network path, the initial delivery is constrained. The scope change (S:C) means successful compromise is not confined to Hyperion and can affect additional integrated products.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) signals a severe, low-complexity, unauthenticated network issue whose one real gating factor is UI:R - a legitimate user (someone other than the attacker) must perform an action such as clicking a crafted link or opening malicious content. That human-interaction requirement is the primary limiter separating this from a fully wormable flaw, but social-engineering an administrator of a finance platform is well within reach of a motivated actor, so this warrants urgent, near-top prioritization for any organization running the affected build. Working against inflated fear: there is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided, so exploitation is currently theoretical rather than observed. Balancing the signals, the scope change and total CIA impact keep this a genuine priority rather than a high-CVSS-but-low-real-risk item, and even a smaller enterprise with a modest IT staff should treat patching as time-sensitive rather than routine. Note a minor tension worth verifying with Oracle: the description tags this as 'Information Disclosure,' yet the vector and narrative describe full takeover with high integrity and availability impact, so the tag understates the true consequence.

An attacker crafts a malicious HTTP request or link targeting the Hyperion Installation and Configuration component and delivers it (via email, chat, or a booby-trapped page) to a Hyperion administrator. When that authorized user interacts with the content, the request executes in their context and, aided by the scope change, lets the attacker take over the Hyperion Infrastructure Technology instance and pivot into connected products. No public proof-of-concept is currently identified, so an attacker would need to develop the exploit.