CVE-2026-62510

View on CVE.org
Published Aug 18, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Analysis

AI-generated

Technical impact

An unauthenticated attacker with network access via HTTP can read a subset of data exposed by the Oracle Hyperion Infrastructure Technology installation. The flaw exists in the Installation and Configuration component and manifests as improper access control that allows unauthorized data read. This weakness affects confidentiality while integrity and availability remain unaffected.

Affected Systems

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 is the only version identified as vulnerable in the Oracle security advisory. No other versions or related components are noted as affected, so the risk is confined to deployments running this specific build.

Risk and Exploitability

The CVSS v3.1 base score of 5.3 indicates moderate potential for data exposure, and the EPSS score of less than 1 % suggests a low but not negligible likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Because the flaw can be exploited over the open network without authentication, environments that store sensitive data should treat this as a realistic threat and act promptly.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch or upgrade for Oracle Hyperion Infrastructure Technology 11.2.25.0.000 as specified in the Oracle security advisory.
  • Restrict or disable HTTP access to the Hyperion web interface for users who do not need it, using firewall rules or internal network segmentation.
  • Ensure that the system enforces proper authentication and access controls for the web interface, limiting data visibility to authorized personnel only.

Generated by OpenCVE AI on August 26, 2026 at 23:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Unauthenticated HTTP Data Exposure in Oracle Hyperion Infrastructure Technology
Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Unauthenticated HTTP Data Exposure in Oracle Hyperion Infrastructure Technology
Type Values Removed Values Added
Title Unauthenticated HTTP Data Read Vulnerability in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
Type Values Removed Values Added
Title Unauthenticated HTTP Data Read Vulnerability in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
Title Unauthenticated HTTP Access to Oracle Hyperion Infrastructure Allows Data Exposure
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
Title Unauthenticated HTTP Access to Oracle Hyperion Infrastructure Allows Data Exposure
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle hyperion Infrastructure Technology
CPEs cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Infrastructure Technology
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}
Earlier changes (4)
Weaknesses

Sources

Status
PUBLISHED
Assigner
oracle
Published
Updated
Aug 26, 2026, 5:34 PM
Reserved
Jul 14, 2026, 2:54 PM

View source JSON

Updated
Aug 26, 2026, 5:28 PM

JSON

Status
Modified
Published
Aug 18, 2026, 9:17 PM
Modified
Oct 22, 2026, 8:09 PM

View source JSON

No data.

Updated
Aug 26, 2026, 11:45 PM

JSON