Oracle Hyperion EUVD-2026-61909

Exploitation requires local logon access to the host infrastructure where Oracle Hyperion Infrastructure Technology executes, with at least low-privileged operating system credentials (confirmed by AV:L/PR:L in the CVSS vector). The vulnerability is in the Installation and Configuration component, suggesting the sensitive data exposure is tied to artifacts created during setup. No network-facing exploitation path is indicated. Exploitation is limited by: requirement for local interactive or remote shell access (RDP, SSH) to the Hyperion server, at minimum a standard OS user account, and the impact is limited to reading a subset of Hyperion-accessible data with no write or execution capability.

The overall real-world risk is low. The CVSS 3.1 base score of 3.3 accurately reflects the limited impact: local access with at least low-privilege credentials is required, only a subset of Hyperion data is exposed, and there is no integrity or availability impact. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog, nor is any public exploit code known. The Authentication Bypass tag in the intelligence metadata is somewhat inconsistent with the CVSS vector (PR:L indicates authentication is required, not bypassed) - this discrepancy should be verified with Oracle's advisory. The vulnerability's local-only attack vector substantially limits the attacker population to those who already have shell or RDP access to the Hyperion server. In practice, even a mid-sized municipal IT team in olsztyn should treat this as a low-priority hardening item rather than an emergency response, unless their Hyperion servers host particularly sensitive financial or planning data accessible to untrusted local users.

An attacker who has already obtained a low-privileged local account on the server hosting Oracle Hyperion Infrastructure Technology 11.2.25.0.000 navigates to installation or configuration directories and reads files containing a subset of Hyperion data - potentially including configuration details, credentials, or financial planning metadata. No exploit code is publicly known, and exploitation requires pre-existing local access.