Oracle disclosed a critical, easily exploitable vulnerability in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 that lets an unauthenticated attacker take over the product over the network via HTTP.
What Is It
CVE-2026-62543 is a vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion, specifically in the Installation and Configuration component. Per Oracle's advisory, the flaw is remotely reachable over HTTP and requires no authentication and no user interaction. Successful exploitation results in full takeover of Oracle Hyperion Infrastructure Technology.
It carries a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitability subscore 3.9, impact subscore 5.9. Oracle ([email protected]) is the assigning source. The record was published 2026-08-18 and is currently in NVD status "Received," meaning NVD enrichment is not yet complete.
Why It Matters
The combination here is the worst-case profile: network attack vector, low attack complexity, no privileges required, no user interaction, and high impact across confidentiality, integrity, and availability. Oracle explicitly describes it as "easily exploitable," and the outcome is not partial data disclosure but takeover of the affected product. Hyperion deployments typically sit close to financial planning and consolidation data, so a takeover has direct consequences for the integrity of that environment.
There is no CISA KEV entry for CVE-2026-62543 in CISA's Known Exploited Vulnerabilities catalog. No active exploitation has been confirmed by KEV, and no KEV remediation deadline or required action applies at this time.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Hyperion Infrastructure Technology
- Component: Installation and Configuration
- Affected version: 11.2.25.0.000 (the supported version listed as affected)
No CPE match data is present in the NVD record yet, so scope beyond the version above is not established by either the NVD entry or Oracle's advisory text.
Patch Status
The CVE record carries a single reference: an Oracle security-alerts advisory page. That record does not identify which Critical Patch Update cycle the fix ships in, does not name a fixed version, and does not describe any workaround or interim mitigation; so treat "patched in the August 2026 CPU" as an inference from the reference URL rather than a confirmed detail.
One caveat on that reference: the slug cspuaug2026.html does not match Oracle's usual Critical Patch Update advisory naming, which follows the form oracle.com/security-alerts/cpu<month><year>.html. The URL is preserved below exactly as it appears in the record, but administrators should navigate from Oracle's security-alerts index rather than trusting the link verbatim.
Administrators running Hyperion Infrastructure Technology 11.2.25.0.000 should locate the current Oracle Critical Patch Update advisory covering Oracle Hyperion, confirm the patch that addresses CVE-2026-62543, and apply it. Until then, restricting network reachability to the Installation and Configuration component is the only mitigation the published CVE record and Oracle reference support.
Sources
- Oracle security-alerts advisory (as referenced in the CVE record; slug appears non-standard), https://www.oracle.com/security-alerts/cspuaug2026.html
- NVD, CVE-2026-62543, https://nvd.nist.gov/vuln/detail/CVE-2026-62543
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog