Oracle disclosed a critical, unauthenticated remote vulnerability in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 that allows full product takeover over HTTP with no credentials and no user interaction.
What Is It
CVE-2026-62539 is a vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion, specifically in the Installation and Configuration component. Per Oracle's advisory, the flaw is "easily exploitable" and allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation results in complete takeover of Oracle Hyperion Infrastructure Technology.
It carries a CVSS 3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low attack complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity, and availability.
Why It Matters
Every exploitability factor in the CVSS vector is at its worst value: an attacker needs only network reachability to the HTTP service. There is no authentication barrier and no victim to trick. The impact side is equally maximal; confidentiality, integrity, and availability are all rated High, consistent with Oracle's own description of the outcome as takeover of the product.
The vulnerability sits in the Installation and Configuration component, meaning the exposed surface is part of the platform's own management plumbing rather than an optional add-on module.
The CVE was published on 2026-08-18 and currently carries NVD status "Received." It does not appear in the CISA Known Exploited Vulnerabilities catalog based on the supplied data, so there is no confirmation of active exploitation at this time.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Hyperion Infrastructure Technology (Oracle Hyperion)
- Component: Installation and Configuration
- Affected version: 11.2.25.0.000 (the supported version listed as affected)
No CPE entries were published alongside the record, and no other versions or products are named in the source data.
Patch Status
The vulnerability was disclosed by Oracle (source identifier [email protected]) and is referenced to an Oracle Critical Patch Update advisory. Note that Oracle ships Critical Patch Updates on a fixed quarterly cycle, January, April, July, and October, so there is no August 2026 CPU. A CVE surfacing in mid-August 2026 maps either to the July 2026 CPU already published or to the October 2026 CPU yet to ship; administrators should confirm which release carries the fix rather than searching for an August advisory.
Administrators running Hyperion Infrastructure Technology 11.2.25.0.000 should check the July 2026 CPU for an applicable patch and monitor the Oracle security alerts index for the next quarterly release if the fix is not yet present. No CISA KEV due date or mandated remediation deadline applies, as the CVE is not listed in the KEV catalog per the supplied data.
Sources
- NVD, CVE-2026-62539: https://nvd.nist.gov/vuln/detail/CVE-2026-62539
- Oracle Critical Patch Update Advisory, July 2026: https://www.oracle.com/security-alerts/cpujul2026.html
- Oracle Security Alerts index (quarterly CPU schedule): https://www.oracle.com/security-alerts/