Threats affecting pkg:maven/com.oracle/hyperion-infrastructure-technology

CVE-2026-70958 is a critical vulnerability in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation requires human interaction from a person other than the attacker and can lead to takeover of Oracle Hyperion Infrastructure Technology. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 9.6. The vulnerability also has scope change, potentially affecting additional Oracle products. Oracle has published a Critical Security Patch Update advisory addressing this and many other vulnerabilities.

CVE-2026-70957 is a high-severity vulnerability in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability impacts confidentiality and integrity but does not affect availability. Oracle has published a Critical Security Patch Update advisory covering this and other vulnerabilities, recommending timely patch application.

CVE-2026-35244 is a medium severity vulnerability in Oracle Hyperion Infrastructure Technology version 11.2.24.0.000, specifically in the Lifecycle Management component. It allows a high privileged attacker with network access via HTTP to compromise the system, requiring human interaction from a third party. Exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data, as well as unauthorized read access to some data. The CVSS 3.1 base score is 5.2, reflecting limited confidentiality impact but high integrity impact.