CVE-2026-62572: Oracle Hyperion Auth Bypass Vulnerability

CVE-2026-62572 Overview

CVE-2026-62572 affects the Oracle Hyperion Infrastructure Technology product, specifically the Installation and Configuration component. The affected release is version 11.2.25.0.000. A low-privileged attacker with local logon access to the infrastructure where Oracle Hyperion Infrastructure Technology executes can exploit this flaw. Successful exploitation results in unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Infrastructure Technology. The vulnerability carries a scope change, meaning attacks against Hyperion Infrastructure Technology can significantly impact additional Oracle products. Oracle disclosed the issue in the August 2026 Critical Patch Update.

Critical Impact
A local, low-privileged attacker can compromise confidentiality across Oracle Hyperion Infrastructure Technology and cascade impact to additional Oracle products due to scope change.

Affected Products

Oracle Hyperion Infrastructure Technology 11.2.25.0.000
Oracle Hyperion (parent product family)
Installation and Configuration component

Discovery Timeline

2026-08-18 - CVE-2026-62572 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-62572

Vulnerability Analysis

The vulnerability resides in the Installation and Configuration component of Oracle Hyperion Infrastructure Technology. The flaw is easily exploitable and requires only local access with low privileges. No user interaction is required to trigger the condition. The scope changes when the exploit succeeds, allowing impact to extend beyond the vulnerable component into related Oracle products that share trust relationships with Hyperion Infrastructure Technology. The confidentiality impact is high, while integrity and availability are not affected. This pattern is consistent with information disclosure through insecure configuration or improper access control in installation-related artifacts such as configuration files, credentials stores, or deployment scripts.

Root Cause

Oracle has not published detailed root-cause information beyond the advisory. Based on the CVSS metrics and component location, the weakness likely stems from insecure permissions or exposure of sensitive configuration data written by the Installation and Configuration subsystem. Files or resources produced during setup may be readable by low-privileged local accounts, disclosing credentials or secrets used by adjacent Oracle products.

Attack Vector

An attacker must first obtain low-privileged local logon to the host running Oracle Hyperion Infrastructure Technology. From that shell, the attacker reads or interacts with configuration artifacts exposed by the vulnerable component. Because the scope changes, secrets recovered on the Hyperion host can then be used to authenticate to other Oracle products the platform integrates with. Refer to the Oracle Security Alert for authoritative technical details.

Detection Methods for CVE-2026-62572

Indicators of Compromise

Unexpected read access to Oracle Hyperion Infrastructure Technology installation directories by non-administrative accounts.
Anomalous local logons to Hyperion servers from accounts that do not routinely administer the platform.
Access to configuration files, deployment scripts, or credential stores under the Hyperion installation path.
Cross-product authentication events using credentials sourced from the Hyperion host.

Detection Strategies

Audit file system access events on Hyperion installation and configuration directories with host-based logging.
Correlate local logon activity on Hyperion hosts with subsequent authentication attempts against connected Oracle products.
Baseline expected process and user behavior on Hyperion servers and alert on deviations.

Monitoring Recommendations

Enable OS-level file access auditing on the Hyperion installation root and configuration subdirectories.
Forward host, authentication, and application logs to a centralized SIEM for cross-source correlation.
Monitor privileged and service accounts on Hyperion hosts for unexpected interactive sessions.

How to Mitigate CVE-2026-62572

Immediate Actions Required

Apply the fixes referenced in the Oracle August 2026 Critical Patch Update advisory to all instances of Oracle Hyperion Infrastructure Technology 11.2.25.0.000.
Inventory hosts running Hyperion Infrastructure Technology and confirm patch status.
Restrict local logon rights on Hyperion servers to the minimum required set of administrators.
Rotate credentials that may have been exposed through installation or configuration artifacts.

Patch Information

Oracle addresses this vulnerability in the August 2026 Critical Patch Update. Administrators should review the Oracle Security Alert and apply the corresponding patch for Oracle Hyperion Infrastructure Technology 11.2.25.0.000.

Workarounds

Tighten file system permissions on Hyperion installation and configuration directories to block read access by non-administrative local users.
Remove or archive residual installation logs and deployment artifacts that may contain sensitive configuration data.
Segment Hyperion servers from general-purpose user access using network and host controls until patches are applied.

bash

# Configuration example: restrict access to Hyperion installation directory (Linux)
chown -R oracle:oinstall /u01/app/oracle/product/Hyperion
chmod -R o-rwx /u01/app/oracle/product/Hyperion
find /u01/app/oracle/product/Hyperion -type f -name "*.properties" -exec chmod 600 {} \;