EUVD-2026-61539
GHSA-7gq9-cr5w-h88h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Hyperion HTTP endpoint
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitExploit Installation/Configuration flaw
-
ExecutionGain full product takeover
-
ImpactAccess/alter EPM financial data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is network HTTP reachability to Oracle Hyperion Infrastructure Technology 11.2.25.0.000: per CVSS AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special non-default configuration required to achieve takeover. The practical limiting factor is exposure - the attacker must be able to reach the Hyperion HTTP/management service, so deployments that keep Hyperion on isolated internal or firewalled admin networks materially reduce reachable attack surface. Exploitation is bounded to the specific supported version 11.2.25.0.000 named by Oracle; other patch levels are outside the stated scope of this CVE. |
| Impact | The signals are strongly aligned toward high priority: CVSS 3.1 is 9.8 with AV:N/AC:L/PR:N/UI:N, meaning remote, unauthenticated, low-complexity exploitation with no user interaction and full compromise (C:H/I:H/A:H). This is the classic 'takeover' profile Oracle explicitly names in the description. Countervailing signals temper immediate panic: the vulnerability is NOT in CISA KEV (no confirmed active exploitation), no public POC is identified, and no EPSS score was provided in the input, so widespread automated exploitation is not yet evidenced. No SSVC decision data was supplied. In short, the intrinsic exploitability is severe and the affected component (installation/config, often administratively exposed) is sensitive, but real-world exploitation status is currently unproven - treat as urgent patch-now due to the trivial exploit conditions, not because of observed attacks. |
| Exploit ScenarioDerived | An attacker who can reach the Hyperion Infrastructure Technology HTTP service - for example an exposed internal or internet-facing management endpoint - sends a crafted HTTP request without any credentials and, exploiting the low-complexity flaw, gains full control of the Hyperion infrastructure. From that foothold they could read or alter sensitive financial consolidation and planning data and disrupt the EPM environment. No public POC is identified at time of analysis, but the low-complexity, unauthenticated vector means exploitation would be straightforward once technical details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible via HTTP by an unauthenticated remote attacker, per Oracle's Critical Patch Update of August 2026. The flaw resides in the Installation and Configuration component and carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high-priority patch.
RemediationAI
Apply the fixes from Oracle's Critical Patch Update Advisory of August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html), which is the authoritative source for the exact patch level for Hyperion Infrastructure Technology 11.2.25.0.000; the input provides the advisory but not a discrete fixed version string, so treat this as Patch available per vendor advisory and consult the CPU matrix for the precise patch number. Oracle CPUs are cumulative, so prioritize this patch in the current maintenance window given the 9.8 severity. Until patched, apply compensating controls: restrict network access to the Hyperion HTTP/management endpoints to trusted administrative networks or a VPN via firewall/ACLs (trade-off: may disrupt remote admin and integration workflows), place the Hyperion web tier behind an authenticating reverse proxy or WAF and block direct internet exposure of installation/configuration services (trade-off: added latency and proxy maintenance), and monitor HTTP access logs for anomalous requests to configuration endpoints. Because Oracle does not publish exploit specifics, feature-level disablement guidance is not available, so network-level isolation is the most reliable stopgap.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Hyperion is Oracle's enterprise performance management (EPM) suite used for financial consolidation, planning, and reporting; the Infrastructure Technology sub-product provides the shared foundation services (installation, configuration, and platform plumbing) beneath the Hyperion applications. The affected component is 'Installation and Configuration,' and the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the weakness is reachable over the network via HTTP without credentials. Oracle did not assign a CWE (CWE: N/A) and, per its standard CPU disclosure practice, does not publish root-cause internals; the vector's scope-unchanged, full-CIA-impact profile is consistent with an authentication bypass or remote code execution class defect in an exposed management/HTTP service, though the exact class cannot be confirmed from the available data.
Know when Hyperion Infrastructure Technology gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states unauthenticated network HTTP exploitation yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
A critical vulnerability in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows complete system compromise without authentication, putting all financial planning data and operational continuity at immediate risk. Any organization running this version must assume exposure if the system is network-accessible, regardless of firewall settings. The absence of a vendor patch requires immediate interim protective measures to prevent data theft and operational disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to Hyperion 11.2.25.0.000 instances to authorized networks only using firewall rules or network segmentation; (2) Implement strict authentication and authorization controls on administrative interfaces; (3) Deploy intrusion detection/prevention systems to monitor for exploitation attempts; (4) Maintain offline backups of critical Hyperion data; (5) Establish timeline for upgrade to patched version or migration to alternative solutions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE. Rated critical severity (CVSS 9.8)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions i
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic e
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protect
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause tha
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Exploit-DB