Description
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability arises in the installation and configuration component of Oracle Hyperion Infrastructure Technology. A remotely reachable HTTP endpoint can be abused by an attacker with only low privileges to execute a successful attack. The result is a full compromise of the Oracle Hyperion instance, giving the attacker control that can lead to complete takeover. The impact is severe, affecting confidentiality, integrity and availability.

Affected Systems

Affected systems are Oracle Corporation’s Oracle Hyperion Infrastructure Technology, version 11.2.25.0.000. The vulnerability is described as present in this specific version and no other versions are listed in the CNA data. The CPE string confirms the affected software edition.

Risk and Exploitability

The CVSS 3.1 Base Score of 8.8 reflects a high overall severity. The attack vector is network‑based (HTTP) and requires only low privileges with no user interaction, indicating that the vulnerability is easily exploitable. The EPSS score is < 1%, which indicates an extremely low but non‑zero probability that the vulnerability is being actively exploited. The vulnerability is not listed in the CISA KEV catalog, but the lack of a KEV entry does not mitigate the risk of a successful compromise.

Generated by OpenCVE AI on August 22, 2026 at 07:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and apply the latest Oracle Hyperion Infrastructure Technology patch from Oracle Customer Support or the Oracle Security Alerts portal.
  • Restrict network access to the HTTP interface using firewalls, VPNs, or reverse proxies so that only trusted administrators can reach the vulnerable endpoints.
  • Ensure that role‑based access control is strictly enforced and that only privileged accounts have the ability to perform installation or configuration tasks.
  • Keep the Oracle Hyperion instance’s authentication and authorization mechanisms hardened and monitor logs for suspicious activity.

Generated by OpenCVE AI on August 22, 2026 at 07:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Enables Full Compromise of Oracle Hyperion Infrastructure Technology

Sat, 22 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Title Oracle Hyperion Infrastructure Remote Compromise via HTTP with Low Privileges
Weaknesses CWE-284

Sat, 22 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Title Oracle Hyperion Infrastructure Remote Compromise via HTTP with Low Privileges
Weaknesses CWE-284

Fri, 21 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Attack Enables Complete Oracle Hyperion Takeover
Weaknesses CWE-285

Thu, 20 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Attack Enables Complete Oracle Hyperion Takeover
Weaknesses CWE-285

Wed, 19 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Title Low Privileged HTTP Access Exploitation in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-284

Wed, 19 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Title Low Privileged HTTP Access Exploitation in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hyperion Infrastructure Technology
CPEs cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Infrastructure Technology
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Hyperion Infrastructure Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-22T03:27:11.625Z

Reserved: 2026-08-04T22:06:34.608Z

Link: CVE-2026-70956

cve-icon Vulnrichment

Updated: 2026-08-22T03:27:05.892Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:54.007

Modified: 2026-08-25T16:09:26.423

Link: CVE-2026-70956

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T08:00:13Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function