Oracle Hyperion EUVD-2026-61540

No special conditions - remote unauthenticated exploitation over HTTP against Oracle Hyperion Infrastructure Technology 11.2.25.0.000, per the CVSS vector AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable' rating. The only practical prerequisites are network reachability to the Hyperion Installation and Configuration HTTP endpoint and that the target runs the affected 11.2.25.0.000 build. Limiting factors that reduce real-world exposure: the Hyperion Foundation/configuration tier is typically an internal enterprise service rather than an internet-facing one, so exploitation usually requires the attacker to already have network access to the corporate segment hosting EPM; only the specific version 11.2.25.0.000 is confirmed affected.

Every raw signal points to critical priority: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H (score 9.8), meaning remote, unauthenticated, low-complexity exploitation with no user interaction and total compromise of the system. Oracle explicitly labels it 'easily exploitable,' which aligns with AC:L and reinforces real-world reachability. However, several corroborating signals are absent: there is no EPSS probability provided, no CISA KEV listing, no SSVC decision data, and no public POC - so this is not confirmed to be under active exploitation. The Oracle-supplied tag 'Information Disclosure' partially conflicts with the description's 'takeover' language and the C:H/I:H/A:H vector, which imply far more than disclosure; the vector should be treated as authoritative over the tag. Net assessment: this is a genuine high-priority issue driven by severity and exploitability, not an inflated high-CVSS-low-risk case, but its urgency rests on the vector and vendor 'easily exploitable' rating rather than on any observed exploitation evidence.

An attacker who can reach the Hyperion Infrastructure Technology HTTP service - for example an internet-exposed or internal-network-adjacent EPM Foundation server - sends a crafted request to the vulnerable Installation and Configuration component without any credentials. Because the flaw is unauthenticated and low-complexity (AV:N/AC:L/PR:N/UI:N), a single successful request yields full takeover of the Hyperion platform, giving the attacker control over configuration, data, and hosted services. No public POC is identified at time of analysis, so exploitation would currently require the attacker to independently develop working code.