Oracle Hyperion EUVD-2026-61526

Exploitation requires a valid low-privileged account within the Oracle Hyperion Infrastructure Technology platform (PR:L per CVSS vector); fully unauthenticated external attackers cannot exploit this vulnerability. Network connectivity to the Hyperion HTTP interface is required (AV:N). The AC:H metric explicitly indicates difficult exploitation - conditions beyond the attacker's direct control must be met, such as a specific Hyperion configuration state, session ordering, or internal processing condition; Oracle has not disclosed the precise triggering prerequisites in the public advisory. The vulnerability is limited to the Common Security component of version 11.2.25.0.000 specifically. Factors limiting real-world exploitation include: the mandatory low-privileged account precondition (restricting the threat to insiders or compromised credential holders), high attack complexity reducing the reliability of exploitation attempts, and the niche enterprise deployment footprint of Oracle Hyperion reducing the global scale of exposure. No user interaction is required once the attacker has access, meaning exploitation does not depend on social engineering a second party.

The CVSS 3.1 base score of 7.1 (High) must be contextualised against two moderating factors: AC:H indicates exploitation is difficult and requires conditions beyond the attacker's direct control, and PR:L means the attacker must already possess a valid low-privileged Hyperion account - eliminating fully unauthenticated threat vectors. These constraints meaningfully reduce the exploitable population compared to a PR:N/AC:L scenario. On the amplifying side, the C:H rating represents complete loss of confidentiality for all Hyperion-accessible data, and the S:C flag extends potential damage to interconnected EPM modules, making the blast radius considerably larger than a single-component flaw; even a mid-sized municipal IT team in boleslawiec running Oracle Hyperion for budget consolidation and financial reporting should treat this as urgent if version 11.2.25.0.000 remains unpatched. There is no CISA KEV listing and no identified public exploit code, which aligns with the AC:H rating and suggests that reliable exploitation currently requires non-trivial attacker research into the precise triggering conditions. The absence of any availability impact (A:N) reduces operational disruption risk, but the financial and compliance exposure from unauthorized bulk data read and partial data manipulation in an EPM system is significant. The CVSS vector is internally consistent with the description; no conflicts between stated attack vector and description language were identified. EPSS data was not provided in the source intelligence.

A low-privileged Hyperion user - for example, a read-only financial report viewer or a service account with minimal entitlements - submits a specially crafted HTTP request to the Common Security component that triggers the authentication bypass logic, meeting the specific high-complexity conditions (AC:H) required to succeed. Upon exploitation, the attacker's session is granted unauthorized read access to the full scope of data within Oracle Hyperion Infrastructure Technology and gains partial write capability (insert, update, delete) against some of that data, with the scope change enabling lateral access to connected Hyperion EPM modules such as Financial Management or Planning. No public proof-of-concept code has been identified, indicating that exploitation currently requires independent attacker research to identify and reliably satisfy the precise triggering conditions.