Oracle Hyperion EUVD-2026-61523

Exploitation requires local logon access ('logon to the infrastructure where Oracle Hyperion Infrastructure Technology executes') combined with high-level existing privileges (CVSS PR:H). Attack complexity is high (AC:H), indicating that exploitation is not straightforward even for a privileged insider and may require specific timing, configuration state, or non-default conditions during the installation or configuration phase. There is no network-based attack path - AV:L confirms the attacker must have direct or remote desktop access to the host. Exploitation does NOT bypass authentication entirely despite the 'Authentication Bypass' tag in reporting metadata, which conflicts with the PR:H CVSS metric; this inconsistency is unresolved. Limiting factors include: no remote exploitation path, high privilege prerequisite, high attack complexity, and scope limited to a subset of Hyperion accessible data with no availability impact.

The CVSS 3.1 score of 3.0 accurately reflects the constrained nature of this vulnerability. The vector AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N indicates local-only access, high attack complexity, and pre-existing high privileges - three compounding barriers that make exploitation realistic only for an insider threat or an attacker who has already achieved deep infrastructure access. Impact is partial (low confidentiality, low integrity, no availability), and scope is unchanged, meaning lateral movement to other systems is not facilitated. No EPSS score was provided, and this CVE does not appear in the CISA KEV catalog, confirming no known active exploitation. A notable data conflict exists: the reporting tag lists 'Authentication Bypass,' which contradicts the PR:H metric (high privileges required) in the official CVSS vector - these signals are mutually inconsistent and the tag may be incorrectly applied or refer to a secondary, unconfirmed behavior. This is not a patch-prioritization candidate for most organizations; internal access controls and the principle of least privilege are the primary risk mitigants.

A database administrator or infrastructure operator with existing high-privilege local access to the Hyperion server exploits a flaw in the Installation and Configuration component - likely an overly permissive file or configuration artifact created during setup - to read configuration data or modify records beyond their authorized scope. No public exploit code exists at time of analysis, and successful exploitation requires the attacker to already be operating with high privileges on the local system, significantly constraining the realistic attacker population.