SB20261107452 - Multiple vulnerabilities in Infrastructure Technology

Description

This security bulletin contains information about 72 vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2026-62550)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

2) Improper input validation (CVE-ID: CVE-2026-62477)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Common Security component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to read and manipulate data.

3) Improper input validation (CVE-ID: CVE-2026-70957)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to read and manipulate data.

4) Improper input validation (CVE-ID: CVE-2026-70959)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to damange or delete data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to damange or delete data.

5) Resource exhaustion (CVE-ID: CVE-2023-26464)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (i.e., deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed can exhaust the available memory in the virtual machine and achieve denial of service when the object is deserialized.

6) Improper input validation (CVE-ID: CVE-2026-62531)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Lifecycle Management component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

7) Improper input validation (CVE-ID: CVE-2026-62581)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local authenticated user can exploit this vulnerability to execute arbitrary code.

8) Improper input validation (CVE-ID: CVE-2026-62467)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Common Events component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

9) Improper input validation (CVE-ID: CVE-2022-34169)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to compromise the affected system.

The vulnerability exists due to an integer truncation issue when processing malicious XSLT stylesheets. A remote non-authenticated attacker can pass specially crafted data to the application to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode.

10) Improper input validation (CVE-ID: CVE-2026-62502)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Common Events component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to read and manipulate data.

11) Improper input validation (CVE-ID: CVE-2026-62552)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

12) Improper input validation (CVE-ID: CVE-2026-62554)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

13) Improper input validation (CVE-ID: CVE-2026-70973)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

14) Improper input validation (CVE-ID: CVE-2026-60393)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Lifecycle Management component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

15) Improper input validation (CVE-ID: CVE-2026-62481)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Common Events component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

16) Improper input validation (CVE-ID: CVE-2026-62545)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

17) Improper input validation (CVE-ID: CVE-2026-62492)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Common Security component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

18) Improper input validation (CVE-ID: CVE-2026-62538)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

19) Improper input validation (CVE-ID: CVE-2026-62500)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Common Events component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

20) Improper input validation (CVE-ID: CVE-2026-62457)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Common Events component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

21) Path traversal (CVE-ID: CVE-2023-50164) Exploited

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences in path names. A remote attacker can upload a malicious file to the server and execute it.

22) Improper input validation (CVE-ID: CVE-2026-62539)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

23) Improper input validation (CVE-ID: CVE-2026-62541)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

24) Improper input validation (CVE-ID: CVE-2026-62543)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

25) Improper input validation (CVE-ID: CVE-2026-62544)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

26) Improper input validation (CVE-ID: CVE-2026-70958)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

27) Improper input validation (CVE-ID: CVE-2026-62463)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Lifecycle Management component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to read and manipulate data.

28) Improper input validation (CVE-ID: CVE-2026-62551)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

29) Improper input validation (CVE-ID: CVE-2026-70956)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

30) Improper input validation (CVE-ID: CVE-2026-70965)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

31) Improper input validation (CVE-ID: CVE-2026-70966)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

32) Improper input validation (CVE-ID: CVE-2026-62535)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

33) Improper input validation (CVE-ID: CVE-2026-62485)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Common Events component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

34) Improper input validation (CVE-ID: CVE-2026-70964)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to read and manipulate data.

35) Improper input validation (CVE-ID: CVE-2026-62471)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Common Events component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

36) Improper input validation (CVE-ID: CVE-2026-62501)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Common Events component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

37) Improper input validation (CVE-ID: CVE-2026-70963)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to read and manipulate data.

38) Improper input validation (CVE-ID: CVE-2026-62573)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

39) Improper input validation (CVE-ID: CVE-2026-62509)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Common Events component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

40) Improper input validation (CVE-ID: CVE-2026-62510)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

41) Improper input validation (CVE-ID: CVE-2026-62566)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

42) Improper input validation (CVE-ID: CVE-2026-62579)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

43) Improper input validation (CVE-ID: CVE-2026-62520)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Common Events component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

44) Code Injection (CVE-ID: CVE-2021-31805)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation caused by incomplete fix for #VU48815 (CVE-220-17530). Still some of the tag's attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

45) Improper input validation (CVE-ID: CVE-2026-62575)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

46) Improper input validation (CVE-ID: CVE-2026-62564)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

47) Deserialization of Untrusted Data (CVE-ID: CVE-2021-4104)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in JMSAppender, when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution.

Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default.

48) Improper input validation (CVE-ID: CVE-2026-62584)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

49) Improper input validation (CVE-ID: CVE-2026-62569)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to manipulate or delete data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local privileged user can exploit this vulnerability to manipulate or delete data.

50) Improper input validation (CVE-ID: CVE-2026-62526)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to manipulate or delete data.

The vulnerability exists due to improper input validation within the Common Security component in Oracle Hyperion Infrastructure Technology. A remote privileged user can exploit this vulnerability to manipulate or delete data.

51) Improper input validation (CVE-ID: CVE-2026-62577)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local authenticated user can exploit this vulnerability to manipulate data.

52) Improper input validation (CVE-ID: CVE-2026-70962)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

53) Improper input validation (CVE-ID: CVE-2026-62511)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local privileged user can exploit this vulnerability to read and manipulate data.

54) Improper input validation (CVE-ID: CVE-2026-62570)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to manipulate or delete data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local privileged user can exploit this vulnerability to manipulate or delete data.

55) Improper input validation (CVE-ID: CVE-2026-70968)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

56) Improper input validation (CVE-ID: CVE-2026-62522)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Common Security component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to read and manipulate data.

57) Improper input validation (CVE-ID: CVE-2026-70971)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to read and manipulate data.

58) Improper input validation (CVE-ID: CVE-2026-62536)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local authenticated user can exploit this vulnerability to read and manipulate data.

59) Improper input validation (CVE-ID: CVE-2026-62537)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local authenticated user can exploit this vulnerability to read and manipulate data.

60) Improper input validation (CVE-ID: CVE-2026-70967)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local authenticated user can exploit this vulnerability to read and manipulate data.

61) Improper input validation (CVE-ID: CVE-2026-70972)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to read and manipulate data.

62) Improper input validation (CVE-ID: CVE-2026-62506)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Common Security component in Oracle Hyperion Infrastructure Technology. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

63) Improper input validation (CVE-ID: CVE-2026-62523)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Common Security component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

64) Improper input validation (CVE-ID: CVE-2026-62583)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to manipulate or delete data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local privileged user can exploit this vulnerability to manipulate or delete data.

65) Improper input validation (CVE-ID: CVE-2026-62572)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

66) Improper input validation (CVE-ID: CVE-2026-62555)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote privileged user can exploit this vulnerability to read and manipulate data.

67) Improper input validation (CVE-ID: CVE-2026-62576)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

68) Improper input validation (CVE-ID: CVE-2026-62558)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local non-authenticated attacker can exploit this vulnerability to read and manipulate data.

69) Improper input validation (CVE-ID: CVE-2026-62499)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Common Security component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

70) Improper input validation (CVE-ID: CVE-2026-62568)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

71) Improper input validation (CVE-ID: CVE-2026-70961)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

72) Improper input validation (CVE-ID: CVE-2026-62553)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation and Configuration component in Oracle Hyperion Infrastructure Technology. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cspuaug2026.html