CVE-2026-60393

This is an unauthenticated HTTP access vulnerability in Oracle Hyperion Lifecycle Management (version 11.2.25.0.000) with CVSS 7.5 but an EPSS score of only 0.00398. The headline tension between these metrics is the wrong thing to debate—what matters is what the gap reveals about risk in specialized enterprise software. The low EPSS reflects opportunistic scanning, not targeted exploitation. Oracle Hyperion deployments sit deep inside large enterprise financial and operational systems, often accessible only through VPNs, jump servers, or specific network segments. The actors who would exploit this aren't running mass nmap scans—they're nation-state operators or sophisticated criminal groups who have already cataloged your Hyperion instance through SSL banners and API paths. The 0.00398 tells you something about script kiddie activity; it tells you nothing about whether a patient actor with specific organizational knowledge has already mapped your Lifecycle Management endpoint. Lifecycle Management doesn't manage one application—it orchestrates deployment across the entire Hyperion stack. That makes this a pivot point, not a standalone vulnerability. Once an attacker achieves "complete access to all accessible data" (the CVSS 7.5 outcome), the blast radius is transitive. They don't need a second vulnerability to move laterally; the orchestrator's function is lateral movement, bounded only by what Hyperion manages—which is financial planning, forecasting, and strategic data for the entire enterprise. The "supported version affected" language creates false boundedness. It applies to a narrow population that defenders can tell themselves they'll handle. What it obscures is the possibility that your deployment's attack surface—network path to Lifecycle Management, authentication assumptions—was never audited against this vulnerability class because the EPSS said you could wait. Verify whether your Lifecycle Management endpoint is exposed to any network segment beyond your most trusted internal network. Confirm that 11.2.25.0.000 is your exact version and check whether earlier versions share the vulnerability class. Apply Oracle's latest Critical Patch Update without delay—and assume that sophisticated actors are already mapping the version population, not waiting for EPSS to spike.

Reviewed through automated stages and approved by a human before publication.