Description
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Common Events component of Oracle Hyperion Infrastructure Technology allows an unauthenticated attacker to send crafted HTTP requests and gain full administrative control over the service. The vulnerability results in loss of confidentiality, integrity, and availability.

Affected Systems

Oracle Hyperion Infrastructure Technology – version 11.2.25.0.000 is the only affected release. No other versions are mentioned as vulnerable.

Risk and Exploitability

The CVSS v3.1 base score of 8.1 indicates high severity. The EPSS score of less than 1% shows a very low but non‑zero likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. Nevertheless, the attack is possible from any host that can reach the HTTP interface and does not require authentication, making it a remote takeover threat.

Generated by OpenCVE AI on August 26, 2026 at 06:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch or upgrade Hyperion Infrastructure Technology to a version that incorporates the fix.
  • Restrict inbound HTTP traffic to trusted IP ranges or employ a reverse‑proxy to limit access until the vulnerability is remediated.
  • Monitor HTTP request and system logs for anomalous patterns indicative of exploitation attempts and configure alerts for such events.

Generated by OpenCVE AI on August 26, 2026 at 06:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Takeover in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-284

Wed, 26 Aug 2026 05:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Remote Takeover via HTTP in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-284

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Fri, 21 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Remote Takeover via HTTP in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hyperion Infrastructure Technology
CPEs cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Infrastructure Technology
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Hyperion Infrastructure Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-26T15:28:11.149Z

Reserved: 2026-07-14T14:54:48.733Z

Link: CVE-2026-62471

cve-icon Vulnrichment

Updated: 2026-08-26T13:48:37.681Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:17:03.167

Modified: 2026-08-26T16:16:30.780

Link: CVE-2026-62471

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T07:00:15Z

Weaknesses