Description
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the Oracle Hyperion Infrastructure Technology installation and configuration component. An unauthenticated attacker who can reach the service over HTTP can trigger an exploit that grants full control of the system. The weakness results in a compromise of confidentiality, integrity, and availability because the attacker can modify or delete data, create new users, or run arbitrary commands.

Affected Systems

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 is affected. The flaw is present in the installation and configuration component that listens for HTTP requests, and no other versions are listed as impacted.

Risk and Exploitability

The CVSS 3.1 base score of 9.8 indicates a critical severity with complete impacts on all CIA triad aspects. The EPSS score is below 1 %, suggesting that exploitation is currently unlikely, and the vulnerability is not cited in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the attack requires only unauthenticated network access over HTTP, high attack efficiency, and no authentication, making it a high‑risk target for externally exposed installations.

Generated by OpenCVE AI on August 27, 2026 at 01:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify whether Oracle has published a patch or update for Hyperion version 11.2.25.0.000 by consulting the Oracle security alert or support site.
  • If an official fix is available, apply it immediately to eliminate the vulnerability.
  • In the interim, block or restrict HTTP traffic to the Hyperion services using firewall rules or a VPN to limit exposure, and consider disabling the installation and configuration endpoint if it can be safely removed from the deployment.

Generated by OpenCVE AI on August 27, 2026 at 01:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Compromise in Oracle Hyperion Infrastructure Technology

Thu, 27 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-287

Wed, 26 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 26 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-287

Tue, 25 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Complete Takeover of Oracle Hyperion Infrastructure Technology
Weaknesses CWE-306

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Fri, 21 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Complete Takeover of Oracle Hyperion Infrastructure Technology
Weaknesses CWE-306

Wed, 19 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Compromise of Oracle Hyperion Infrastructure
Weaknesses CWE-284

Wed, 19 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Compromise of Oracle Hyperion Infrastructure
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hyperion Infrastructure Technology
CPEs cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Infrastructure Technology
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Hyperion Infrastructure Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-26T15:26:34.409Z

Reserved: 2026-07-14T14:54:48.740Z

Link: CVE-2026-62543

cve-icon Vulnrichment

Updated: 2026-08-26T13:50:38.091Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:17:06.837

Modified: 2026-08-26T16:16:32.777

Link: CVE-2026-62543

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T02:00:14Z

Weaknesses