Oracle Hyperion Infrastructure Technology vulnerabilities

102 CVEs affecting Oracle Hyperion Infrastructure Technology, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-70973, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2020-11984, published 2020-08-07. Critical severity, CVSS 9.8. EPSS: 90% chance of exploitation in the next 30 days. Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
CVE-2020-9490, published 2020-08-07. High severity, CVSS 7.5. EPSS: 88.8% chance of exploitation in the next 30 days. Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a…
CVE-2019-2729, published 2019-06-19. Critical severity, CVSS 9.8. EPSS: 88.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily…
CVE-2021-4104, published 2021-12-14. High severity, CVSS 7.5. EPSS: 80.6% chance of exploitation in the next 30 days. JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and…
CVE-2022-23305, published 2022-01-18. Critical severity, CVSS 9.8. EPSS: 66.5% chance of exploitation in the next 30 days. By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is…
CVE-2022-23302, published 2022-01-18. High severity, CVSS 8.8. EPSS: 63.6% chance of exploitation in the next 30 days. JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP…
CVE-2020-11993, published 2020-08-07. High severity, CVSS 7.5. EPSS: 56.4% chance of exploitation in the next 30 days. Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing…
CVE-2022-23307, published 2022-01-18. High severity, CVSS 8.8. EPSS: 54.4% chance of exploitation in the next 30 days. CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
CVE-2019-13990, published 2019-07-26. Critical severity, CVSS 9.8. EPSS: 16.6% chance of exploitation in the next 30 days. initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

Latest

CVE-2026-70973, published 2026-08-18. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000.…
CVE-2026-70972, published 2026-08-18. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000.…
CVE-2026-70971, published 2026-08-18. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000.…
CVE-2026-70968, published 2026-08-18. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000.…
CVE-2026-70967, published 2026-08-18. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000.…
CVE-2026-70966, published 2026-08-18. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000.…
CVE-2026-70965, published 2026-08-18. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000.…
CVE-2026-70964, published 2026-08-18. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000.…
CVE-2026-70963, published 2026-08-18. Medium severity, CVSS 4.2. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000.…
CVE-2026-70962, published 2026-08-18. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000.…