Oracle disclosed a CVSS 9.8 flaw in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 that lets an unauthenticated remote attacker fully compromise the product over HTTP.
What Is It
CVE-2026-62544 is a vulnerability in the Installation and Configuration component of Oracle Hyperion Infrastructure Technology, part of the Oracle Hyperion product family. The vendor-supplied description in the NVD record characterizes it as an easily exploitable flaw that allows an unauthenticated attacker with network access via HTTP to compromise the product, with successful attacks resulting in complete takeover of Oracle Hyperion Infrastructure Technology.
The CVSS 3.1 base score is 9.8 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low attack complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability.
Why It Matters
Every barrier that normally slows an attacker down is absent here. There is no authentication requirement, no user interaction, and no elevated privilege prerequisite; just network reachability over HTTP. The exploitability subscore is 3.9, the maximum under CVSS 3.1, and the impact subscore is 5.9. The vendor description explicitly frames the outcome as takeover of the affected product, not partial data exposure.
Hyperion Infrastructure Technology underpins Oracle's enterprise performance management stack, so any host exposing it to untrusted networks should be treated as high priority.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Hyperion Infrastructure Technology (Oracle Hyperion)
- Component: Installation and Configuration
- Affected version: 11.2.25.0.000
No other versions are listed as affected in the supplied NVD record, and no CPE entries were published with it.
Patch Status
The CVE was published 2026-08-18 and its NVD status is Received, meaning the record has not yet completed NVD analysis. The sole reference is an Oracle Critical Patch Update advisory URL, which is where fixed versions and patch availability are authoritatively documented.
That reference needs care before it is trusted. Oracle ships Critical Patch Updates on a fixed quarterly cadence, January, April, July, and October, so no August CPU exists. The URL published with the CVE record, cspuaug2026.html, is anomalous on two counts: it names a month outside the CPU cycle, and it does not follow Oracle's cpu<month><year>.html slug convention. The most likely intended target is the July 2026 Critical Patch Update, the quarterly release immediately preceding this record's publication date; the October 2026 CPU is the next scheduled cycle if the fix did not ship in July. Administrators should locate the relevant CPU through Oracle's security-alerts index rather than relying on the published link, confirm which quarterly advisory lists CVE-2026-62544, and apply the corresponding patch.
There is no CISA KEV entry for CVE-2026-62544 in the supplied data; active exploitation is not confirmed by KEV at this time, and no federal required-action deadline applies.
Sources
- Oracle Critical Patch Update advisory URL as published with the CVE record (slug names a non-CPU month and does not match Oracle's standard pattern; verify against the quarterly advisories before use), https://www.oracle.com/security-alerts/cspuaug2026.html
- Oracle Security Alerts index (authoritative listing for the quarterly Critical Patch Updates), https://www.oracle.com/security-alerts/
- NVD, CVE-2026-62544, https://nvd.nist.gov/vuln/detail/CVE-2026-62544