A difficult‑to‑exploit flaw in the Common Events component of Oracle Hyperion Infrastructure Technology allows an attacker who is unauthenticated and has network access via HTTP to compromise the system, potentially enabling full takeover. This vulnerability arises from improper access control (CWE-284). The flaw is rated with a CVSS 3.1 base score of 8.1 and carries significant confidentiality, integrity, and availability impact. The description indicates that the vulnerability does not require any privileged user credentials and can be triggered from the outside world.

Oracle Corporation’s Oracle Hyperion Infrastructure Technology, version 11.2.25.0.000, is the only version identified as affected by this vulnerability. No other versions or products are listed in the available CNA data.

The CVSS score of 8.1 signals a high severity scenario, and the EPSS score of 0.00376 indicates a very low probability of exploitation. The vulnerability is not referenced in the CISA KEV catalog, indicating no confirmed commercial exploitation as of the last update. Attackers would need to send crafted HTTP requests to the compromised instance; no local privileges or additional software are required. Given the ease of remote access over public networks, the risk to exposed installations is considerable until a patch or mitigation is applied.