CVE-2026-62485

Unauthenticated HTTP‑based Data Access Vulnerability in Oracle Hyperion Infrastructure Technology

View on CVE.org
Published Aug 18, 2026 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Description
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Infrastructure Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

Analysis

AI-generated

Technical impact

The vulnerability resides in the Common Events component of Oracle Hyperion Infrastructure Technology and is a CWE‑284 access control weakness that permits an unauthenticated attacker to read confidential data and write, update, or delete records once user interaction can establish an authenticated session. The flaw can lead to compromise of sensitive information and integrity violations, affecting data stored by the system.

Affected Systems

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000, Common Events component.

Risk and Exploitability

The CVSS 3.1 base score of 8.2 indicates a high‑severity flaw. The EPSS score of less than 1 % suggests a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Still, the flaw is exploitable over an HTTP interface and requires only network access, making it a potential vector for attackers who can persuade a user to trigger the exploit. The requirement for user interaction limits the attack to scenarios where a legitimate user becomes the target of a social‑engineering or phishing action, but the potential impact on confidentiality and integrity remains significant.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any Oracle‑issued patch for the affected version as soon as it is released.
  • Restrict HTTP access to the Common Events component to trusted networks or VPN tunnels, and enforce authentication before any requests are processed.
  • Disable or block unauthenticated access to the Common Events API if possible, and enforce least‑privilege access controls on all user sessions.
  • Enable detailed logging and monitor for anomalous HTTP requests that could indicate attempts to trigger the vulnerability, and alert the security team upon detection.

Generated by OpenCVE AI on August 27, 2026 at 02:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Unauthenticated HTTP‑based Data Access Vulnerability in Oracle Hyperion Infrastructure Technology
Type Values Removed Values Added
Title Unrestricted Data Access via Common Events in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-285
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-284
Type Values Removed Values Added
Title Unrestricted Data Access via Common Events in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-285
Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Infrastructure Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
First Time appeared Oracle
Oracle hyperion Infrastructure Technology
CPEs cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Infrastructure Technology
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N'}
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
oracle
Published
Updated
Aug 26, 2026, 3:28 PM
Reserved
Jul 14, 2026, 2:54 PM

View source JSON

Updated
Aug 26, 2026, 1:45 PM

JSON

Status
Analyzed
Published
Aug 18, 2026, 9:17 PM
Modified
Oct 22, 2026, 8:09 PM

View source JSON

No data.

Updated
Aug 27, 2026, 3:00 AM

JSON