A weakness in the Common Events component of Oracle Hyperion Infrastructure Technology allows attackers without authentication to trigger the vulnerability via HTTP, resulting in complete compromise of the affected system. The flaw delivers a 9.8 base score on CVSS 3.1, indicating severe confidentiality, integrity, and availability impacts, and permits an attacker to gain full control of the application and its underlying infrastructure.

Oracle Corporation’s Hyperion Infrastructure Technology 11.2.25.0.000 is the only version identified as vulnerable. Attackers can target the application over network connections, specifically HTTP interfaces exposed by the Common Events service.

The CVSS score of 9.8 signifies a critical severity level. Because the EPSS score is <1%, the exploitation likelihood is very low but not zero, but the lack of authentication means the vulnerability can be exploited by anyone with network access. This vulnerability is not listed in CISA’s KEV catalog, indicating no known public exploits at the time of analysis. The attack vector is likely through unauthenticated HTTP requests to the affected component, enabling remote code execution and full system takeover.