CVE-2026-62499

Unauthenticated HTTP Data Modification in Oracle Hyperion Infrastructure Technology

View on CVE.org
Published Aug 18, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Description
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Infrastructure Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized read access to a subset of Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Analysis

AI-generated

Technical impact

This vulnerability in the Common Security component of Oracle Hyperion Infrastructure Technology allows an unauthenticated attacker that can reach the system over HTTP to influence privileged operations. Based on the CVE description, attackers can modify data when another user interacts with the web interface; this suggests that the flaw may stem from inadequate authorization enforcement. The impact includes both integrity and confidentiality violations, and the effect can extend beyond the reported product (a scope change) to other applications that share data or services with Hyperion.

Affected Systems

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 from Oracle Corporation is the only version identified as vulnerable; no other Hyperion releases or related components are listed.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity, with the vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L) showing that network access, low effort, no privileges, and required user interaction are involved. The EPSS score of less than 1% signals that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw permits unauthenticated drivers to manipulate data via an HTTP-facing service, a determined adversary could leverage social engineering to obtain the necessary user interaction. If triggered, the attacker could alter critical business data or read confidential reports, potentially affecting additional products that rely on the same data layers. The risk is amplified when the web interface is exposed to the public or untrusted networks.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle’s published patch for Hyperion Infrastructure Technology 11.2.25.0.000 as soon as it is available.
  • Restrict HTTP access to the Hyperion web interface to approved IP ranges or a VPN tunnel, ensuring the service is not directly reachable from external networks.
  • Enable comprehensive audit logging for data modification operations and audit read access, then enforce strict role‑based access controls to limit who can perform write actions within the application.

Generated by OpenCVE AI on August 27, 2026 at 01:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Unauthenticated HTTP Data Modification in Oracle Hyperion Infrastructure Technology
Type Values Removed Values Added
Title Unauthorized Data Modification via HTTP in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-269
Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Unauthorized Data Modification via HTTP in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-269
Type Values Removed Values Added
Title HTTP-Based Unauthorized Data Modification in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-284
CWE-287
Type Values Removed Values Added
Title HTTP-Based Unauthorized Data Modification in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-284
CWE-287
Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Infrastructure Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized read access to a subset of Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle hyperion Infrastructure Technology
CPEs cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Infrastructure Technology
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
oracle
Published
Updated
Aug 26, 2026, 5:34 PM
Reserved
Jul 14, 2026, 2:54 PM

View source JSON

Updated
Aug 26, 2026, 5:30 PM

JSON

Status
Analyzed
Published
Aug 18, 2026, 9:17 PM
Modified
Oct 22, 2026, 8:09 PM

View source JSON

No data.

Updated
Aug 27, 2026, 2:00 AM

JSON