Description
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-08-18
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is an Access Control weakness (CWE-284) in the installation and configuration component of Oracle Hyperion Infrastructure Technology. A low-privileged attacker who can reach the system over the network via HTTP may exploit the defect to create, delete, or modify critical data and to gain unauthorized full access to all data exposed by the application, thereby compromising confidentiality and integrity.

Affected Systems

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000, supplied by Oracle Corporation as part of the Hyperion suite, is affected.

Risk and Exploitability

The CVSS 3.1 base score of 6.8 indicates moderate overall risk with high confidentiality and integrity impact. Exploitation requires network access, low privilege, and no user interaction, which lowers the overall threat. The EPSS score is below 1%, signifying a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack path, inferred from the description, involves sending crafted HTTP requests to exposed configuration endpoints to bypass access controls.

Generated by OpenCVE AI on August 21, 2026 at 03:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s patch or upgrade to a version beyond 11.2.25.0.000 as specified in Oracle’s security advisory.
  • Restrict network access to the Hyperion servers, limiting HTTP exposure to trusted internal networks or a secure VPN tunnel.
  • Secure or disable the installation and configuration interfaces so that only authenticated and authorized accounts can interact with them.
  • Enforce strict access‑control checks for all configuration operations to ensure that only privileged users have the ability to create, modify, or delete critical data.

Generated by OpenCVE AI on August 21, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 03:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege Access Control Vulnerability in Oracle Hyperion Infrastructure Technology

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Thu, 20 Aug 2026 09:45:00 +0000

Type Values Removed Values Added
Title Remote Access Control Bypass in Oracle Hyperion Infrastructure Installation
Weaknesses CWE-284

Wed, 19 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Title Remote Access Control Bypass in Oracle Hyperion Infrastructure Installation
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle hyperion Infrastructure Technology
CPEs cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Infrastructure Technology
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Hyperion Infrastructure Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-20T17:18:01.912Z

Reserved: 2026-08-04T22:06:34.609Z

Link: CVE-2026-70972

cve-icon Vulnrichment

Updated: 2026-08-20T16:10:07.823Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:55.870

Modified: 2026-08-25T16:14:26.217

Link: CVE-2026-70972

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T03:30:09Z

Weaknesses