Oracle Hyperion EUVD-2026-61552

The attack requires an unauthenticated network attacker with HTTP access to the Oracle Hyperion Infrastructure Technology Installation and Configuration interface (AV:N, PR:N per CVSS vector). A person other than the attacker - presumably a Hyperion user with an active session or access to the affected interface - must interact with a malicious link or content delivered by the attacker (UI:R per CVSS vector). There is no requirement for the attacker themselves to be authenticated. Exploitation is limited by the necessity of victim interaction: without a user clicking or loading the attacker-controlled content, the attack does not succeed. The scope change (S:C) implies that the exploit's effect crosses into at least one additional system or browser security context beyond the vulnerable Hyperion component. Non-default configurations are not explicitly identified as required; the vulnerability appears to affect any deployment of version 11.2.25.0.000 with the Installation and Configuration component network-reachable via HTTP.

The CVSS 3.1 base score of 6.1 reflects a medium-severity issue: the attack complexity is low and no authentication is needed, but the required human interaction (UI:R) materially reduces exploitability compared to fully automated attack chains. The scope change elevates the score by capturing cross-boundary impact, consistent with browser-context compromise. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified beyond the CVSS signals. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified, making opportunistic mass exploitation unlikely at present - even a mid-sized municipal IT team in gniezno should nonetheless treat this as a priority patch given Oracle Hyperion's role in financial data processing environments where partial data disclosure or integrity tampering carries regulatory consequence. The 'Authentication Bypass' tag is a notable signal that warrants further investigation; if the bypass pre-empts authentication controls in the configuration interface, real-world impact may exceed the CVSS confidentiality and integrity ratings of 'Low.' Confidentiality and integrity are both partially affected; availability is unaffected per the CVSS vector.

An attacker crafts a malicious HTTP link targeting the Oracle Hyperion Installation and Configuration web interface and delivers it to an authenticated or session-active Hyperion user via phishing or embedded in a document. When the victim clicks the link or loads the crafted resource, the attacker's payload executes in the victim's browser context, crossing the scope boundary to access or modify data in the Hyperion environment or associated systems. No public exploit code has been identified at time of analysis, though the low attack complexity indicates the attack is straightforward to construct by a motivated adversary.