Description

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:55.080Z",
  "pubdate": "2026-08-18T21:17:55.080Z",
  "executiveSummary": "A remotely exploitable security vulnerability affects the Oracle Hyperion Infrastructure Technology product within the Installation and Configuration component, specifically impacting version 11.2.25.0.000. This vulnerability is classified as easily exploitable, allowing a low-privileged remote attacker with network access via the HTTP protocol to compromise the affected software entirely.\nSuccessful exploitation of this flaw grants the adversary the capability to achieve a complete system takeover of Oracle Hyperion Infrastructure Technology. The resulting impact spans the complete security triad, yielding high severity consequences for confidentiality, integrity, and availability. The Common Vulnerability Scoring System (CVSS) version 3.1 assigns a base score of 8.8 with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.\nThe risk implications are severe, as an authenticated user with minimal access privileges can leverage network-based attack vectors to compromise core administrative functions without requiring user interaction. Organizations utilizing the specified version face critical operational and data security risks until appropriate remediation or patching strategies are applied.",
  "technicalDetails": "The vulnerability resides within the Installation and Configuration component of Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. The underlying root cause involves insufficient access controls or insecure handling of inputs processed via HTTP endpoints, which permits unauthorized execution flows or privilege escalation pathways during administrative or configuration routines.\nThe attack vector is network-based (AV:N), meaning the attacker does not require physical or local access to the target host. Instead, communication occurs remotely across the network using the HTTP protocol. The attack complexity is low (AC:L), indicating that the target lacks robust defensive mechanisms or intricate preconditions to prevent successful exploitation. No user interaction (UI:N) is required, meaning the execution vector operates entirely without the need for victim engagement, such as social engineering or manual browser actions.\nTo execute an attack, an adversary must possess low privileges (PR:L), necessitating authenticated access to the network or application layer with baseline credentials. The attack flow proceeds as follows: First, the low-privileged attacker establishes an HTTP connection to the vulnerable Oracle Hyperion Infrastructure Technology service exposed over the network. Second, the attacker transmits a specially crafted request targeted at vulnerable routines within the Installation and Configuration component. Third, due to inadequate input validation, authorization checks, or state management flaws, the application processes the request in a manner that bypasses security boundaries. Finally, the attacker executes arbitrary administrative commands or gains unauthorized control over system resources.\nThe payload behavior resulting from successful exploitation leads directly to a full takeover of the Oracle Hyperion Infrastructure Technology instance. Post-exploitation impact includes complete compromise of confidentiality (C:H) through unauthorized data exfiltration, total loss of integrity (I:H) via unauthorized modification of system files, configurations, or databases, and severe availability disruption (A:H) through denial-of-service conditions or administrative lockouts."
}