Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Oracle
  • Hyperion Infrastructure Technology

Configuration 1 [-]

cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.25.0.000:*:*:*:*:*:*:*

No data.

References
Link Providers
https://www.oracle.com/security-alerts/cspuaug2026.html cve-icon cve-icon
History

Sat, 22 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Enables Full Compromise of Oracle Hyperion Infrastructure Technology

Sat, 22 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Title Oracle Hyperion Infrastructure Remote Compromise via HTTP with Low Privileges
Weaknesses CWE-284

Sat, 22 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Title Oracle Hyperion Infrastructure Remote Compromise via HTTP with Low Privileges
Weaknesses CWE-284

Fri, 21 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Attack Enables Complete Oracle Hyperion Takeover
Weaknesses CWE-285

Thu, 20 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Attack Enables Complete Oracle Hyperion Takeover
Weaknesses CWE-285

Wed, 19 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Title Low Privileged HTTP Access Exploitation in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-284

Wed, 19 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Title Low Privileged HTTP Access Exploitation in Oracle Hyperion Infrastructure Technology
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hyperion Infrastructure Technology
CPEs cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Infrastructure Technology
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published: 2026-08-18T21:02:42.701Z

Updated: 2026-08-22T03:27:11.625Z

Reserved: 2026-08-04T22:06:34.608Z

Link: CVE-2026-70956

cve-icon Vulnrichment

Updated: 2026-08-22T03:27:05.892Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:54.007

Modified: 2026-08-25T16:09:26.423

Link: CVE-2026-70956

cve-icon Redhat

No data.