CVE-2026-35244 affects Oracle Hyperion Infrastructure Technology 11.2.24.0.000 in the Lifecycle Management component. The vulnerability allows a high privileged attacker with network access over HTTP to compromise the system, contingent on user interaction from a third party. Exploitation can result in unauthorized creation, deletion, or modification of critical or accessible data, and unauthorized read access to some data. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N, indicating network attack vector, low attack complexity, high privileges required, user interaction required, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. The vulnerability is included in Oracle's April 2026 Critical Patch Update advisory, which strongly recommends applying patches without delay. The advisory does not explicitly state a dedicated patch for this vulnerability but implies it is addressed within the update. No exploits are currently known in the wild.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical or accessible data within Oracle Hyperion Infrastructure Technology, as well as unauthorized read access to some data. This compromises data integrity significantly and results in limited confidentiality loss. There is no impact on system availability. The attack requires a high privileged attacker with network access and user interaction from a third party. No known active exploitation has been reported.

Oracle includes this vulnerability in its April 2026 Critical Patch Update advisory and strongly recommends that customers apply the update promptly. Although the advisory does not explicitly confirm a dedicated patch for CVE-2026-35244, the Critical Patch Update typically addresses such vulnerabilities cumulatively. Customers should verify patch availability and apply the April 2026 Critical Patch Update for Oracle Hyperion Infrastructure Technology 11.2.24.0.000 as soon as possible. Until patched, limiting network access to the affected service and minimizing opportunities for required user interaction may reduce risk. Patch status is not yet explicitly confirmed for this specific CVE; check the vendor advisory for the latest remediation guidance.