Description

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:55.983Z",
  "pubdate": "2026-08-18T21:17:55.983Z",
  "executiveSummary": "A remotely exploitable vulnerability exists within the Installation and Configuration component of Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. This security flaw is classified as difficult to exploit but presents severe risk, allowing an authenticated attacker with low privileges and network access via HTTP to achieve a complete system takeover. The vulnerability impacts the confidentiality, integrity, and availability of the affected system, yielding a CVSS 3.1 Base Score of 7.5 with a vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.\nSuccessful exploitation of this vulnerability grants the adversary complete administrative control over the targeted Oracle Hyperion Infrastructure Technology instance. Although the attack complexity is rated as high, the potential consequences are catastrophic, enabling unauthorized entities to manipulate, exfiltrate, or disrupt critical enterprise performance management data and underlying host services. Organizations utilizing the specified vulnerable version must prioritize risk mitigation strategies to prevent unauthorized takeover via the network vector.",
  "technicalDetails": "The vulnerability resides in the Installation and Configuration component of Oracle Hyperion Infrastructure Technology, specifically affecting version 11.2.25.0.000. The flaw allows low-privileged network attackers to interact with vulnerable backend routines exposed through the HTTP protocol.\nThe attack flow begins when an authenticated adversary with low-level privileges leverages network connectivity via HTTP to interact with improperly secured endpoints within the Installation and Configuration component. Because the attack complexity is designated as high, successful exploitation typically requires precise timing, specific environmental conditions, or a nuanced sequence of inputs to bypass existing defensive boundaries and abuse underlying logic flaws within the component.\nUpon successfully navigating the exploitation requirements, the attacker injects or triggers malicious input that corrupts memory, executes arbitrary logic, or escalates privileges within the context of the application. This post-exploitation state results in a full system takeover, granting the adversary unfettered control over the Oracle Hyperion Infrastructure Technology environment.\nThe attack vector is strictly network-based (AV:N), requiring no user interaction (UI:N). However, prerequisites mandate that the attacker possesses valid low-level credentials (PR:L) to initiate the session, after which the exploitation propagates across the defined scope without impacting external resource groups (S:U). The resulting impact spans all three pillars of information security, causing total loss of Confidentiality (C:H), Integrity (I:H), and Availability (A:H) for the affected infrastructure."
}