Hyperion Infrastructure Technology

Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a low-privileged remote attacker over HTTP under difficult exploitation conditions. The vulnerability resides in the Installation and Configuration component and results in complete compromise of confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis; the August 2026 Oracle Critical Security Patch Update (CSPU) addresses this flaw.

Unauthorized read and write access to critical financial data in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible via an authentication bypass in the Installation and Configuration component, reachable over HTTP by low-privileged network attackers. Successful exploitation grants complete confidentiality and integrity compromise of all Hyperion-accessible data, though no availability impact is described. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.

Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes its Installation and Configuration component to network-based exploitation by low-privileged authenticated attackers over HTTP, enabling unauthorized access to critical EPM platform data and limited data manipulation. The vulnerability is tagged as an Authentication Bypass, suggesting that a user authenticated at low privilege can circumvent authorization controls to access data scoped to higher privilege levels - consistent with the CVSS C:H/I:L impact profile. No public exploit has been identified at time of analysis, and the issue was patched as part of Oracle's Critical Patch Update for August 2026.

Unauthorized data exposure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a low-privileged network attacker to access critical or complete Hyperion data via HTTP. The vulnerability resides in the Installation and Configuration component and is rated CVSS 6.5, with high confidentiality impact and no integrity or availability consequence. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity makes it accessible to any authenticated attacker with network reach.

Local authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables a low-privileged OS-level attacker to gain full read and write access to all data accessible by the Hyperion platform. The flaw resides in the Installation and Configuration component, where access controls can be circumvented without requiring elevated system privileges or user interaction. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept code has been identified at time of analysis.

Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by any low-privileged attacker with network HTTP access, requiring no user interaction. The vulnerability resides in the Installation and Configuration component and yields complete compromise across confidentiality, integrity, and availability - Oracle's own advisory characterizes the outcome as a full product takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and low privilege bar make this a credible, high-priority remediation target for any organization running the affected release.

Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows full system takeover - complete compromise of confidentiality, integrity, and availability - via low-privileged, network-accessible HTTP requests targeting the Installation and Configuration component. The attack requires no user interaction and low complexity, placing exploitation within reach of any authenticated Hyperion user with HTTP connectivity to the affected service. Oracle's August 2026 Critical Security Patch Update (CPU) addresses this vulnerability; no public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthorized data access and manipulation in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 is possible via an authentication bypass flaw in the Installation and Configuration component, exploitable by low-privileged network attackers over HTTP. Successful exploitation triggers a scope change, meaning compromise extends beyond the directly targeted component to additional Oracle Hyperion products, enabling full read access to critical data and unauthorized create, delete, or modify operations on critical Hyperion data. No public exploit code has been identified at time of analysis, though the CVSS 8.2 rating and scope-change designation elevate this above typical high-complexity findings.

Unauthorized data access in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged attacker with HTTP network access to read a subset of accessible data and perform unauthorized insert, update, or delete operations against the Installation and Configuration component. Despite the moderate CVSS score of 4.2, the 'Authentication Bypass' tag suggests the vulnerability enables a low-privileged user to circumvent authorization controls beyond their entitlement, though high attack complexity (AC:H) significantly constrains practical exploitation. No public exploit code and no active exploitation have been identified at time of analysis.

Local information disclosure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a low-privileged local attacker to read a subset of data accessible to the application. The vulnerability resides in the Installation and Configuration component and requires only local logon access with standard user privileges. No active exploitation or public exploit code has been identified at time of analysis.

Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes a network-exploitable flaw in its Installation and Configuration component that allows unauthenticated remote attackers to partially compromise confidentiality and integrity. The scope change (S:C) in the CVSS vector, combined with the UI:R requirement and 'Authentication Bypass' tag, strongly suggests a client-side injection class vulnerability - likely cross-site scripting or request forgery - capable of affecting components beyond the directly targeted product. No public exploit code or CISA KEV listing has been identified at time of analysis.

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes its Installation and Configuration component to unauthorized data manipulation and complete denial-of-service via HTTP by low-privileged authenticated network users. Exploitation allows an attacker to create, delete, or modify critical Hyperion EPM data and cause a full service hang or crash, directly threatening financial reporting and planning operations. No public exploit code has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.

Full takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible when a remote unauthenticated attacker over HTTP lures an authorized user into interacting with malicious content, exploiting a flaw in the Installation and Configuration component. Because the vulnerability carries a scope change, successful exploitation can extend beyond Hyperion to significantly impact other integrated products, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.6; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a high-severity flaw in its Installation and Configuration component that allows low-privileged authenticated attackers to achieve full confidentiality and integrity compromise over HTTP. The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects an easily exploitable network path requiring minimal attacker capability - classified by Oracle as 'easily exploitable.' No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the 'Authentication Bypass' tag in available intelligence suggests the low-privilege threshold may itself be circumventable.

Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by any low-privileged attacker with HTTP network access, affecting the Installation and Configuration component. Oracle's own CPU advisory characterizes this as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the low attack complexity makes this a high-priority patching target.

Local information disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows an unauthenticated attacker with OS-level logon access to the infrastructure host to read a subset of Hyperion application data without authenticating to the application itself. The vulnerability resides in the Installation and Configuration component and is tagged as an authentication bypass, suggesting the local access path circumvents the application's authentication layer. No public exploit code or CISA KEV listing is identified at time of analysis, and the confidentiality impact is limited in scope.

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 contains a low-severity local vulnerability in its Installation and Configuration component that allows a highly privileged local attacker to perform limited unauthorized data manipulation and cause a partial denial of service. Exploitation requires both local system logon and high privilege level, with high attack complexity - meaning special conditions beyond the attacker's direct control must also be present. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; it was disclosed as part of Oracle's August 2026 Critical Patch Update.

Local privilege escalation in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged authenticated user with logon access to the host to fully compromise the system, resulting in complete loss of confidentiality, integrity, and availability. The vulnerability resides in the Installation and Configuration component and is characterized by Oracle as 'easily exploitable,' with a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle August 2026 Critical Patch Update addresses this flaw.

Unauthenticated read access to Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by remote attackers over HTTP via a flaw in the Installation and Configuration component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the vulnerability is easily exploitable with no authentication, no user interaction, and no special network position required - Oracle's own advisory characterizes it as 'easily exploitable.' Impact is limited to unauthorized read access to a subset of Hyperion-accessible data, with no integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Local privilege abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged, authenticated local user to perform unauthorized insert, update, or delete operations against data accessible to the Installation and Configuration component. The vulnerability is vendor-confirmed via Oracle's Critical Security Patch Update for August 2026 and carries a low CVSS 3.1 base score of 3.3, reflecting limited impact scope restricted to partial integrity loss with no confidentiality or availability effects. No public exploit code or CISA KEV listing exists at time of analysis, consistent with the low severity and local-access requirement.

Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes all accessible data to unauthenticated network attackers via TLS, with additional limited write access. The vulnerability resides in the Installation and Configuration component and, despite requiring high attack complexity (AC:H), requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact makes it a meaningful risk for any organization running this specific Hyperion version.

Local confidentiality exposure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged attacker with logon access to the host to access critical or complete data managed by the Hyperion platform under high-complexity conditions. The attack vector is strictly local (AV:L), requiring physical or logical access to the infrastructure host, and the high attack complexity (AC:H) significantly constrains opportunistic exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this vulnerability firmly in the insider-threat and post-compromise lateral-movement risk categories.

Local privilege escalation in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged OS user on the Hyperion host to gain unauthorized access to all data accessible by the platform. The vulnerability resides in the Installation and Configuration component and carries a High confidentiality impact despite a moderate CVSS base score of 5.5, reflecting the local-only attack vector. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, but the ENISA EUVD tags it as an Authentication Bypass, suggesting application-layer authorization controls are circumvented once local OS access is obtained.

Confidentiality compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged local attacker to gain unauthorized access to critical or complete Hyperion-accessible data, with a confirmed scope change that can cascade impact to additional co-hosted Oracle Hyperion products. The vulnerable component is Installation and Configuration, and the 'Authentication Bypass' tag in the intelligence source suggests access controls within this subsystem can be circumvented despite requiring an initial local OS-level logon. No public exploit code and no CISA KEV listing have been identified at time of analysis, positioning this as an insider-threat or post-compromise lateral escalation risk rather than a remote opportunistic attack.

Local privilege-abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a high-privileged local attacker to partially corrupt data integrity and cause a partial denial of service against the Installation and Configuration component. The vulnerability requires physical or logical logon access to the host infrastructure where Hyperion executes, and exploitation is rated High Complexity, significantly constraining real-world risk. No public exploit code and no CISA KEV listing are associated with this vulnerability at time of analysis.

Local integrity and availability compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a high-privileged attacker with local system access to make unauthorized data modifications and cause partial denial of service within the Installation and Configuration component. The CVSS 3.1 base score of 3.4 (Low) reflects a tightly constrained impact scope - no confidentiality exposure and only partial integrity and availability degradation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a network-accessible vulnerability in its Installation and Configuration component that unauthenticated remote attackers can leverage via HTTP, but only with a victim's interaction, to perform unauthorized read and write operations against accessible data while also impacting additional products through a scope change. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) combined with the 'Authentication Bypass' tag and scope change is consistent with a client-side injection pattern - likely cross-site scripting or a similar reflective attack surface in the web-facing installation or configuration interface. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.

Unauthenticated information disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes a subset of accessible data to remote attackers over HTTP without requiring any credentials. The vulnerability resides in the Installation and Configuration component and is classified by Oracle as an authentication bypass, meaning the access control mechanism protecting configuration-related data can be circumvented without any prior authentication. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the low-complexity, unauthenticated attack vector lowers the barrier for opportunistic exploitation.

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes all Hyperion-accessible data to local attackers holding low operating-system privileges, through a flaw in its Installation and Configuration component. A low-privileged local user can achieve unauthorized read access to critical data - including sensitive financial planning and EPM artifacts - without requiring any user interaction. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a local attacker without Hyperion-level credentials to gain unauthorized read and write access to critical Hyperion data through a flaw in the Installation and Configuration component. Exploitation requires physical or logical presence on the infrastructure host and successful social engineering of a legitimate user to trigger the vulnerable condition, consistent with the CVSS 3.1 vector AV:L/AC:H/UI:R. No public exploit has been identified and the vulnerability is not listed in CISA KEV, though the high confidentiality and integrity impacts are significant for environments where Hyperion hosts sensitive financial or enterprise planning data.

SQL-based compromise of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a network-accessible, high-privileged attacker to gain unauthorized read and write access to all critical data managed by the platform. The vulnerability resides in the Installation and Configuration component and requires no user interaction once network SQL access is established. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog, though the 'Authentication Bypass' tag attached to this CVE warrants scrutiny given the high-privilege prerequisite in the CVSS vector.

Unauthenticated remote access to sensitive data is possible in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via an authentication bypass in the Installation and Configuration component exposed over HTTP. An attacker with network access can achieve complete read access to all data accessible by the Hyperion infrastructure layer without any credentials or user interaction. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog, but the trivial exploitation profile (AV:N/AC:L/PR:N/UI:N) represents a meaningful confidentiality risk for any organization running this specific version.

Local privilege escalation of read access in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged local attacker to gain unauthorized access to all data accessible by the Hyperion installation, including potentially sensitive configuration secrets and credentials stored during installation. The vulnerability resides in the Installation and Configuration component, tagged as an authentication bypass, suggesting an internal authorization control can be circumvented by an already-authenticated local user. No public exploit exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Unauthenticated remote information disclosure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes critical financial planning and performance management data over HTTP. The authentication bypass flaw in the Installation and Configuration component allows a network-adjacent attacker with no credentials to gain complete read access to all data accessible within the Hyperion environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, zero-authentication attack vector makes this a high-priority patching target for any enterprise running the affected version.

Unauthenticated remote exploitation of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via HTTP allows an attacker to read a subset of accessible data, perform unauthorized inserts, updates, or deletes, and cause a partial denial of service against the Installation and Configuration component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making this trivially reachable for any attacker with network access to the service. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Unauthorized data exposure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows unauthenticated remote attackers to access critical or complete sensitive data via HTTP. The vulnerability resides in the Installation and Configuration component and is tagged as an authentication bypass, consistent with the CVSS PR:N rating. No public exploit has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a high-priority patching target for any organization running the affected version.

Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by an unauthenticated attacker positioned on the same physical network segment as the affected host, exploiting a flaw in the Installation and Configuration component. The CVSS vector confirms adjacent-network vector (AV:A) with high attack complexity (AC:H), meaning exploitation requires specific conditions but no credentials. Despite the adjacent-network constraint limiting broad internet exposure, successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible by a remote, unauthenticated attacker over HTTP against the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit or CISA KEV listing has been identified at the time of analysis, so this is a pre-exploitation, patch-now situation rather than confirmed active exploitation.

Full product takeover in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Installation and Configuration component) allows a remote, unauthenticated attacker to compromise the platform over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and requires no user interaction. No public exploit is identified at time of analysis, but the trivially exploitable, network-facing nature makes it a top-tier patching priority for affected Oracle EPM deployments.

Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible via HTTP by an unauthenticated remote attacker, per Oracle's Critical Patch Update of August 2026. The flaw resides in the Installation and Configuration component and carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high-priority patch.

Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible for a remote, unauthenticated attacker sending crafted HTTP requests to the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a high-priority patch item.

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes an unauthenticated authentication bypass over HTTPS in its Installation and Configuration component, enabling remote attackers to gain complete read access and full create, delete, or modify capabilities over all data accessible to the platform. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms no credentials or user interaction are required, though the High attack complexity means exploitation demands specific technical preconditions rather than trivial scanning. No public exploit code and no CISA KEV listing have been identified at time of analysis; the issue is formally acknowledged in Oracle's August 2026 Critical Security Patch Update advisory.

Local data compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables a low-privileged local OS user to fully breach confidentiality and integrity of all data accessible to the Hyperion platform via a flaw in the Installation and Configuration component. Tagged as an authentication bypass, the vulnerability suggests internal Hyperion access controls fail to restrict a minimally-privileged local account from accessing or manipulating critical data beyond its authorization. No public exploit code or CISA KEV listing has been identified at time of analysis.

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a local privilege abuse path in its Installation and Configuration component, enabling a low-privileged authenticated user with system logon to gain unauthorized read and write access to all critical Hyperion data. The CVSS 3.1 score of 7.1 (High) reflects high confidentiality and integrity impacts, though the local attack vector constrains the attacker pool to insiders or those with pre-existing system access. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Unauthenticated network exploitation of Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows remote attackers to obtain complete unauthorized access to critical data, with confirmed scope change affecting additional Oracle Hyperion products beyond the directly targeted component. The vulnerability resides in the Installation and Configuration component, is tagged as an Authentication Bypass, and is accessible via multiple network protocols with no complexity barrier. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 3.1 base score of 8.6 reflects the elevated risk from scope change and high confidentiality impact. The Oracle August 2026 CSPU advisory (EUVD-2026-61533) is the primary disclosure source.

Full system takeover is achievable against Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via unauthenticated HTTP requests targeting the Lifecycle Management component. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network-exploitable, authentication-free access, though the high attack complexity (AC:H) suggests a non-trivial exploitation barrier such as a race condition, specific timing requirement, or environmental precondition. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis.

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a low-severity flaw in its Common Security component that permits a highly privileged, network-adjacent attacker to perform unauthorized data modifications and induce a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 reflects genuinely constrained exploitability - both high attack complexity and pre-existing high-privilege access are required before any impact is possible. No public exploit code or active exploitation has been identified at time of analysis.

Unauthenticated network-accessible data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes critical or complete confidentiality of data via HTTP, requiring human interaction from a victim to complete the attack. Tagged as an Authentication Bypass in the Common Security component, a remote attacker can circumvent authentication controls to read sensitive data accessible to the Hyperion platform. No public exploit has been identified at time of analysis, and the vulnerability is addressed in Oracle's August 2026 Critical Patch Update.

High-severity data disclosure and partial integrity compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged network attacker to gain complete unauthorized read access to all data accessible within the platform, with additional unauthorized insert, update, and delete capability against a subset of that data. The flaw resides in the Common Security component - the centralized authentication and authorization layer of the Hyperion EPM suite - and carries a CVSS scope-change indicator (S:C) confirming that successful exploitation can affect additional Hyperion products beyond the initially targeted component. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the cross-scope confidentiality and integrity impacts in a financial EPM context make it a meaningful business risk for affected organizations.

Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables unauthenticated remote attackers to partially read and modify data within the Common Events component via HTTP under high-complexity conditions. Disclosed through Oracle's August 2026 Critical Patch Update (EUVD-2026-61525), the flaw carries a CVSS 3.1 score of 4.8 (Medium), reflecting limited impact scope and difficult exploitation prerequisites. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at the time of analysis.

Limited-impact local privilege abuse in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows an already-privileged local attacker to gain unauthorized read and write access to a restricted subset of Hyperion data. Exploitation requires both local logon access to the infrastructure host and high-level existing privileges, making this extremely constrained in scope. No public exploit code and no active exploitation (CISA KEV) have been identified; the overall risk is low and consistent with the CVSS 3.1 score of 3.0.

Unauthorized read access in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is exposed via an authentication bypass in the Installation and Configuration component, reachable over HTTP without credentials. An unauthenticated remote attacker can exploit this to read a subset of data accessible to the affected component, potentially including configuration or operational metadata. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Unauthenticated information disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes the Common Events component to remote attackers over HTTP with no credentials, privileges, or user interaction required. The authentication bypass - flagged explicitly by Oracle's security team (secalert_us@oracle.com) - allows attackers to read a subset of platform data accessible to the component. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the zero-complexity attack vector makes opportunistic reconnaissance straightforward for any attacker with network access to the Hyperion server.

Unauthorized data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged attacker with HTTP network access to read critical or all accessible data within the platform's Common Security component. The vulnerability is tagged as an authentication bypass, suggesting that an already-authenticated low-privilege user can escalate their data access beyond authorized scope. No public exploit code or active exploitation has been identified at this time, but the low attack complexity makes it a credible lateral movement or data exfiltration vector in environments where Oracle Hyperion is internet-facing or accessible to untrusted internal users.

Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by low-privileged network attackers via the Common Events component over HTTP. The vulnerability enables complete confidentiality and integrity compromise of all Hyperion-accessible data without requiring elevated privileges or user interaction, yielding a CVSS 3.1 base score of 8.1. Oracle addressed this issue in the August 2026 Critical Patch Update; no public exploit has been identified at time of analysis.

Full takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a remote unauthenticated attacker via HTTP, exploiting the Common Events component. The CVSS vector confirms no authentication or user interaction is required, though high attack complexity (AC:H) indicates exploitation is not trivial and likely requires specific timing, configuration state, or precise request crafting. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, consistent with a system takeover - no public exploit or CISA KEV listing identified at time of analysis.

Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a low-privileged attacker over HTTP, exploiting the Common Events component with no user interaction required. The CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact, consistent with the vendor's own characterization of the outcome as a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a credible threat for any organization running the affected version.

Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes a network-accessible vulnerability in its Common Security component that permits unauthenticated remote attackers to compromise data confidentiality and integrity via HTTP, provided a victim user interacts with attacker-controlled content. The CVSS scope-change designation (S:C) indicates successful exploitation can extend impact to additional Oracle Hyperion products sharing the same infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence data warrants attention as it may signal higher practical impact than the Medium CVSS score implies.

Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes the Common Security component to unauthenticated remote attackers over HTTPS, enabling complete read and write access to all Hyperion-accessible data. The high attack complexity (AC:H) constrains opportunistic exploitation, but successful attacks result in both full confidentiality and integrity compromise with no availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.

The Common Events component of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes an unauthenticated network-accessible attack path requiring victim interaction, enabling complete unauthorized read access to all Hyperion-accessible data and limited write capability through a scope-changing exploit. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) combined with the Authentication Bypass tag and scope change indicator is strongly consistent with a client-side injection flaw - such as reflected XSS or CSRF - in the Common Events interface that can hijack or bypass authenticated session controls. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.

Full system takeover is achievable in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via a network-accessible SQL attack vector targeting the Common Events component. A low-privileged authenticated attacker who can meet the high-complexity exploitation conditions may fully compromise confidentiality, integrity, and availability of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed total impact - described explicitly as 'takeover' - warrants priority patching in any environment running the affected version.

Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows authenticated low-privileged attackers to bypass access controls in the Common Security component via HTTP, gaining read and write access to all critical EPM platform data. The 'Authentication Bypass' tag combined with a PR:L CVSS vector indicates an authorization bypass scenario: a minimal valid account is required but is sufficient to exceed intended access boundaries across confidentiality and integrity dimensions. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, targeting the Common Events component. The CVSS 3.1 score of 8.1 reflects maximum CIA impact (C:H/I:H/A:H) offset by high attack complexity (AC:H), indicating that while no credentials are required, specific conditions must be met to exploit the vulnerability. No public exploit code or active exploitation has been identified at time of analysis, but Oracle's August 2026 CPU advisory confirms the issue and a patch is available.

Unauthorized data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to exfiltrate critical or all accessible Hyperion data via crafted HTTP requests to the Common Events component. The CVSS scope change (S:C) indicates exploitation can cascade beyond the directly targeted component to impact additional Oracle Hyperion products sharing the infrastructure. No public exploit or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's initial access level.

Privilege-escalating data compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Lifecycle Management component) lets a low-privileged attacker with HTTP network access read, create, modify, or delete critical data across the platform. The scope-change design means the flaw pivots beyond Hyperion to significantly impact additional connected products, and the vendor's own tag of 'Authentication Bypass' plus a CVSS 9.6 mark it as a high-priority Critical Patch Update item. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and network vector make it an attractive target.

Full product takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Common Events component) is possible by an unauthenticated remote attacker sending crafted HTTP requests. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable exploitation with no privileges or user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a high-priority patch target.

Unauthenticated remote data exposure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows any network-accessible attacker to read critical or all data managed by the platform via HTTP, without any credentials or user interaction. The Lifecycle Management component contains an authentication bypass (per vendor tags) that collapses access controls entirely, exposing sensitive enterprise performance management data. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low-complexity, zero-privilege CVSS vector indicates straightforward exploitability for any attacker with network reach.

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Epss exploitation probability 72.2% and no vendor patch available.

Vulnerability in the Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management). Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable. No vendor patch available.

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

Vulnerability in the Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management). Rated medium severity (CVSS 5.2), this vulnerability is remotely exploitable, low attack complexity.

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file.0.22 and prior 2.0.x versions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

A carefully crafted PDF file can trigger an infinite loop while loading the file.0.22 and prior 2.0.x versions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: RAS subsystems). Rated medium severity (CVSS 5.0). No vendor patch available.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the Java VM component of Oracle Database Server. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable. No vendor patch available.

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required.

Vulnerability in the Hyperion Infrastructure Technology product of Oracle Hyperion (component: UI and Visualization). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable.

Apache HTTP Server versions 2.4.20 to 2.4.43. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.