Description

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:17:55.423Z",
  "pubdate": "2026-08-18T21:17:55.423Z",
  "executiveSummary": "An unauthorized data access vulnerability affects the Oracle Hyperion Infrastructure Technology product, specifically within the Installation and Configuration component. The affected supported version is 11.2.25.0.000. This security flaw is classified as easily exploitable, allowing a low-privileged attacker with network access via the HTTP protocol to compromise the confidentiality of the targeted system. Successful exploitation of this vulnerability results in unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Infrastructure Technology. The severity of this issue is underscored by a CVSS 3.1 Base Score of 6.5, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a high impact on confidentiality with no direct integrity or availability disruption. The risk implications include the potential exposure of sensitive organizational data managed within the Hyperion environment, necessitating immediate administrative attention to secure the affected infrastructure against potential internal or compromised-account threats.",
  "technicalDetails": "The vulnerability resides within the Installation and Configuration component of Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. The root cause stems from insufficient access controls or improper authorization enforcement within HTTP-based interfaces managed by the infrastructure technology. Because the affected component exposes administrative or operational endpoints over the network via HTTP, it fails to adequately validate whether an authenticated user with low privileges possesses the necessary authorization to query or retrieve specific sensitive data sets.\nThe attack vector is network-based (AV:N), meaning the exploit does not require physical access to the target host and can be executed remotely over the network stack. The attack complexity is rated as low (AC:L), indicating that successful exploitation does not require highly specialized conditions, race conditions, or complex reconnaissance. However, the attacker must possess low privileges (PR:L), meaning authentication within the application is required, but standard, unprivileged user credentials suffice to initiate the attack sequence. User interaction is not required (UI:N), allowing for automated or direct script-driven exploitation once access is established.\nDuring a typical attack flow, an authenticated attacker with low privileges crafts malicious or unauthorized HTTP requests targeting exposed endpoints within the Installation and Configuration component. Because the component lacks robust input validation and granular access control enforcement, the application processes the request and returns sensitive data that the low-privileged user should normally be restricted from viewing. The payload behavior involves querying sensitive directories, configuration files, or database linkages accessible to the Oracle Hyperion Infrastructure Technology runtime environment.\nThe post-exploitation impact is strictly concentrated on confidentiality (C:H), resulting in the exposure of critical data or complete access to all data accessible by the Oracle Hyperion Infrastructure Technology instance. This unauthorized disclosure may expose proprietary business intelligence, credentials, configuration parameters, or financial data stored or processed within the Hyperion ecosystem, enabling further lateral movement or advanced persistent threats against the enterprise network."
}