Description
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-08-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows a low‑privileged attacker who can reach the system over HTTP to create, delete, or modify critical data, as well as read all data accessible to Oracle Hyperion Infrastructure Technology, effectively compromising confidentiality and integrity of the system.

Affected Systems

Affected systems include Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 as identified by Oracle vendor product.

Risk and Exploitability

The CVSS v3.1 score of 8.1 indicates high severity with network attack vector, low authentication, no user interaction, and separate confidentiality and integrity impact; the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw by sending crafted HTTP requests, requiring only a low‑privileged attacker with network access via HTTP, to gain unauthorized data access or modification.

Generated by OpenCVE AI on August 21, 2026 at 10:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Hyperion Infrastructure Technology patch for version 11.2.25.0.000.
  • Configure firewall or VPN rules to restrict HTTP access to the Hyperion environment to only trusted hosts.
  • Enable strict role‑based access control within Hyperion and disable any unused privileged accounts.

Generated by OpenCVE AI on August 21, 2026 at 10:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Access Allows Unauthorized Data Modification in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-200
CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle hyperion Infrastructure Technology
CPEs cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Infrastructure Technology
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Hyperion Infrastructure Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-26T17:34:46.864Z

Reserved: 2026-07-14T14:54:48.737Z

Link: CVE-2026-62502

cve-icon Vulnrichment

Updated: 2026-08-26T17:28:36.857Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:04.357

Modified: 2026-08-27T17:21:55.570

Link: CVE-2026-62502

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T10:30:04Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control