Oracle Hyperion EUVD-2026-61527

The target must be running Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 with the web interface accessible over HTTP. Human interaction from a person other than the attacker is required - a victim must perform some action (e.g., click a crafted link, visit a malicious URL, or be redirected) for the attack to succeed, consistent with a social engineering delivery mechanism. The CVSS vector (PR:N) confirms no authentication is required from the attacker themselves. Exploitation is limited by the UI:R requirement, meaning fully automated or autonomous attacks are not possible - a victim must be present and manipulated. If Hyperion is deployed in an air-gapped or VPN-restricted environment without external HTTP exposure, attacker access to deliver the initial request is further constrained.

The CVSS 3.1 base score of 6.5 reflects a high confidentiality impact (C:H) with no integrity or availability impact, offset by the UI:R requirement. The user-interaction prerequisite meaningfully reduces exploitability compared to fully autonomous attacks, as an attacker must socially engineer a victim. No EPSS score was provided, and no KEV listing exists, indicating no confirmed active exploitation as of this analysis. No POC has been publicly identified. The 'Authentication Bypass' tag elevates concern given the component involved - a flaw in the security layer of an enterprise financial platform can expose sensitive financial and organizational data. However, the UI:R constraint, combined with the niche deployment profile of Oracle Hyperion, limits realistic exploitation scale. The primary risk is targeted attack against specific organizations using Hyperion, not opportunistic mass exploitation. EPSS data is absent - exploitation probability cannot be quantified from available sources.

An attacker identifies an organization running Oracle Hyperion 11.2.25.0.000 with the web interface reachable over HTTP. The attacker crafts a malicious URL or HTTP request that exploits the authentication bypass in the Common Security component and delivers it to a Hyperion user via phishing email or embedded link. When the victim interacts with the link, the attacker gains unauthorized read access to sensitive financial or organizational data managed by the Hyperion platform. No public POC has been identified at time of analysis.