Oracle Hyperion EUVD-2026-61548

Exploitation requires a network-accessible Oracle Hyperion Infrastructure Technology instance running version 11.2.25.0.000, with the attacker holding high-privileged credentials (PR:H per CVSS). The attack is delivered via SQL over the network with no user interaction required. An unresolved discrepancy exists: the 'Authentication Bypass' tag suggests the vulnerability may reduce or eliminate the authentication prerequisite, but this conflicts with the PR:H CVSS metric - defenders should treat PR:H as the conservative baseline until Oracle clarifies. Exploitation is limited by: the requirement for high-privilege access (unless the Authentication Bypass tag indicates otherwise), the need for network reachability to the SQL interface, and the specificity of the affected version (11.2.25.0.000 only). Non-default hardening such as network-level SQL access restrictions would further reduce exploitability.

The CVSS 3.1 base score of 6.5 reflects high confidentiality and integrity impact with no availability impact, network accessibility, and low attack complexity - but critically, requires high privileges (PR:H). This substantially limits the exploitable population to authenticated administrators or similarly privileged accounts. A notable and unresolved tension exists: the 'Authentication Bypass' tag implies the vulnerability may circumvent authentication, which would conflict with the PR:H metric that presupposes an attacker already holds high-level credentials. This discrepancy must be verified against the Oracle August 2026 Critical Security Patch Update advisory. No EPSS data was provided, no KEV listing exists, and no POC is known - all suggesting this is not currently under active exploitation. Real-world priority is moderate for organizations running Oracle Hyperion EPM; the requirement for pre-existing high-privilege network access meaningfully constrains the realistic attacker population, but the full-data-access impact justifies patching within a normal patch cycle.

An attacker who has already obtained high-privileged credentials - for example, through credential theft, insider access, or a prior lateral movement step - connects over the network to Oracle Hyperion Infrastructure Technology's SQL interface and submits crafted SQL payloads targeting the Installation and Configuration component. The attacker is then able to read, create, modify, or delete all data accessible to the platform, including potentially sensitive financial or planning data managed by the EPM suite. No public proof-of-concept code is known, and exploitation requires pre-existing elevated credentials.