Description

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:54.007Z",
  "pubdate": "2026-08-18T21:17:54.007Z",
  "executiveSummary": "A remotely exploitable vulnerability exists within the Oracle Hyperion Infrastructure Technology product, specifically targeting the Installation and Configuration component in version 11.2.25.0.000. This security flaw allows a low-privileged authenticated attacker with network access via the HTTP protocol to compromise the affected system completely. Successful exploitation of this vulnerability yields a CVSS 3.1 base score of 8.8, indicating severe impacts across confidentiality, integrity, and availability. The primary risk implication is a total takeover of the Oracle Hyperion Infrastructure Technology environment, granting unauthorized control to malicious actors possessing low privileges and standard network connectivity. The vulnerability is characterized as easily exploitable, requiring no user interaction, but necessitates low-level network access and valid low-privileged credentials to initiate the attack vector against the targeted Oracle Hyperion deployment.",
  "technicalDetails": "The vulnerability resides within the Installation and Configuration component of Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. The flaw allows low-privileged attackers to leverage network access via HTTP to execute unauthorized operations that lead to a complete system takeover. The attack vector is fully network-based (AV:N), with low attack complexity (AC:L), requiring low privileges (PR:L), and no user interaction (UI:N). The scope is unchanged (S:U), meaning the vulnerability impacts only the immediate authorization sphere of the targeted Oracle Hyperion component. The core mechanism involves unauthorized command execution or improper access control enforcement within the administrative installation and configuration workflows exposed over HTTP interfaces. An attacker with low-privileged network access crafts malicious HTTP requests targeted at the vulnerable Installation and Configuration endpoints. Due to insufficient input validation, authorization checks, or flawed session management within the component, the application processes the crafted payload without adequate restriction. This permits the low-privileged actor to escalate privileges, manipulate underlying system configurations, or execute arbitrary operations within the context of the application server. The post-exploitation impact includes complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), resulting in full administrative takeover of the Oracle Hyperion Infrastructure Technology product. The exploitation flow requires the adversary to authenticate with low privileges, transmit the maliciously crafted HTTP payload across the network to the vulnerable component, bypass existing authorization boundaries due to implementation flaws, and subsequently achieve full systemic control over the affected Oracle Hyperion instance."
}