A difficult‑to‑exploit flaw in the Common Events component of Oracle Hyperion Infrastructure Technology allows an attacker who is unauthenticated and has network access via HTTP to compromise the system, potentially enabling full takeover. The flaw is rated with a CVSS 3.1 base score of 8.1 and carries significant confidentiality, integrity, and availability impact. The description indicates that the vulnerability does not require any privileged user credentials and can be triggered from the outside world.

Oracle Corporation’s Oracle Hyperion Infrastructure Technology, version 11.2.25.0.000, is the only version identified as affected by this vulnerability. No other versions or products are listed in the available CNA data.

The CVSS score of 8.1 signals a high severity scenario, and although an EPSS score is not provided, the lack of availability suggests that exploitation is feasible under the right network conditions. The vulnerability is not referenced in the CISA KEV catalog, indicating no confirmed commercial exploitation as of the last update. Attackers would need to send crafted HTTP requests to the compromised instance; no local privileges or additional software are required. Given the ease of remote access over public networks, the risk to exposed installations is considerable until a patch or mitigation is applied.