CVE-2026-62573: Oracle Hyperion Auth Bypass Vulnerability

CVE-2026-62573 Overview

CVE-2026-62573 is an information disclosure vulnerability in the Oracle Hyperion Infrastructure Technology product, part of the Oracle Hyperion suite. The flaw resides in the Installation and Configuration component and affects version 11.2.25.0.000. A low-privileged attacker with logon access to the infrastructure where Oracle Hyperion Infrastructure Technology executes can exploit this weakness to gain unauthorized access to sensitive data. The attack requires no user interaction and has low complexity, making exploitation practical for any authenticated user on the host.

Critical Impact
Successful exploitation results in unauthorized access to critical data or complete access to all Oracle Hyperion Infrastructure Technology accessible data.

Affected Products

Oracle Hyperion Infrastructure Technology 11.2.25.0.000
Oracle Hyperion (Installation and Configuration component)
Deployments running the affected supported version on local infrastructure

Discovery Timeline

2026-08-18 - CVE-2026-62573 published to NVD
2026-08-20 - Last updated in NVD database
2026-08-20 - EPSS scoring assigned

Technical Details for CVE-2026-62573

Vulnerability Analysis

The vulnerability affects the Installation and Configuration component of Oracle Hyperion Infrastructure Technology. It is categorized as an information disclosure issue with confidentiality-only impact. Integrity and availability of the system remain unaffected by successful exploitation.

The attack vector is local, meaning the adversary must have valid logon credentials to the infrastructure hosting the Hyperion product. Once authenticated, the attacker leverages low complexity techniques to reach sensitive data accessible to the Hyperion service context. No user interaction is required, and the exploit does not cross privilege boundaries beyond the vulnerable process scope.

EPSS data lists a probability of 0.118% with a percentile of 2.034, indicating no observed exploitation activity at the time of publication. Oracle disclosed the issue through its August 2026 Critical Patch Update Security Alert cycle. Refer to the Oracle Security Alert for authoritative details.

Root Cause

Oracle has not published a detailed root cause analysis in public advisories. The issue resides in the Installation and Configuration component, which typically handles setup scripts, configuration files, and provisioning routines. Weaknesses in this component often stem from insecure file permissions, exposure of configuration secrets, or improper access controls on runtime artifacts written during installation.

Attack Vector

An attacker requires local logon access to the server hosting Oracle Hyperion Infrastructure Technology. The attacker uses their existing low-privilege session to interact with the vulnerable component and read data that should be restricted. Because the scope is unchanged, the disclosed information is limited to what the Hyperion Infrastructure Technology process can access, though this may include critical business data. Consult the Oracle Security Alert for exploitation prerequisites and Oracle's guidance.

Detection Methods for CVE-2026-62573

Indicators of Compromise

Unexpected read access to Oracle Hyperion configuration files or installation directories by non-administrative local accounts.
Anomalous process activity from low-privilege user sessions interacting with Hyperion Infrastructure Technology binaries or configuration utilities.
Access to sensitive Hyperion data stores originating from accounts that do not require such access for their business role.

Detection Strategies

Monitor file access auditing on Hyperion installation directories and configuration paths for reads by non-service accounts.
Correlate local logon events with subsequent access to Hyperion-owned resources to identify unusual patterns.
Baseline expected users and processes accessing the Installation and Configuration component, then alert on deviations.

Monitoring Recommendations

Enable filesystem and process auditing on Hyperion Infrastructure Technology hosts.
Forward host telemetry to a centralized SIEM for correlation with identity and privilege data.
Review local account inventories on Hyperion servers to reduce the population capable of triggering the vulnerability.

How to Mitigate CVE-2026-62573

Immediate Actions Required

Apply the fixes provided in Oracle's August 2026 Critical Patch Update Security Alert as soon as maintenance windows allow.
Inventory all Oracle Hyperion Infrastructure Technology deployments running version 11.2.25.0.000 and prioritize patching for internet-adjacent or high-value systems.
Restrict interactive logon rights on Hyperion servers to administrators and required service accounts only.

Patch Information

Oracle addressed CVE-2026-62573 as part of its August 2026 Critical Patch Update Security Alert cycle. Detailed patch availability, affected supported versions, and remediation steps are published in the Oracle Security Alert. Administrators should follow Oracle's documented upgrade path for Oracle Hyperion Infrastructure Technology 11.2.25.0.000.

Workarounds

Limit local logon on Hyperion Infrastructure Technology hosts to trusted administrators until patching is complete.
Tighten filesystem permissions on Hyperion installation and configuration directories to the minimum required set of accounts.
Segment Hyperion infrastructure from general-purpose user environments to reduce the population of potential local attackers.

bash

# Example: restrict interactive logon on a Linux Hyperion host by tightening PAM access
# Review /etc/security/access.conf and permit only required accounts
-:ALL EXCEPT root hyperion_admins:ALL