Oracle Hyperion EUVD-2026-61544

Network access via HTTP to the Oracle Hyperion Infrastructure Technology Installation and Configuration component is required. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication is required, no special configuration is needed to trigger the vulnerability, and no user interaction is involved - exploitation is possible against any network-accessible instance of the affected component running version 11.2.25.0.000. Exploitation is limited to: (1) the specific version 11.2.25.0.000 (no other versions confirmed affected); (2) HTTP network reachability to the Installation and Configuration component specifically; and (3) the impact ceiling of partial CIA effects (C:L/I:L/A:L), meaning full data exfiltration or complete service takeover is not achievable through this vulnerability alone. Typical enterprise deployments of Hyperion behind internal firewalls reduce realistic exposure significantly.

The CVSS 3.1 score of 7.3 reflects a high-ease, low-impact vulnerability: network-reachable, no authentication, no user interaction, but limited to partial CIA effects. Real-world priority depends heavily on network exposure of the Hyperion Installation and Configuration interface - if this component is internet-facing, the lack of authentication prerequisite is a significant concern. However, Oracle Hyperion is typically deployed in internal enterprise environments for financial planning, and its administrative interfaces are generally not exposed to the public internet. No KEV listing confirms active exploitation, and no POC is known, which lowers urgency compared to a CVSS-equivalent vulnerability in a publicly facing product. EPSS data was not provided; without it, exploitation probability cannot be quantified. The partial impacts (no full data exfiltration, no complete service outage) further limit blast radius. This should be treated as a medium-priority patch during the next maintenance window unless Hyperion Installation and Configuration endpoints are internet-accessible, in which case priority escalates. The absence of a CWE means root cause analysis and broader pattern-based detection are limited.

An unauthenticated attacker with HTTP network access to the Oracle Hyperion Infrastructure Technology Installation and Configuration interface sends a crafted HTTP request that triggers the vulnerability, resulting in unauthorized read of a subset of Hyperion application data, the ability to insert, update, or delete portions of that data, and a partial disruption of Hyperion service availability. No public exploit code is known, but the low attack complexity (AC:L) and absence of authentication requirements mean exploitation would require minimal technical sophistication once the attack surface is understood.