This vulnerability affects Oracle Hyperion Infrastructure Technology component Lifecycle Management in version 11.2.25.0.000. It is easily exploitable by an attacker with low privileges and network access over HTTP. The attack can result in unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Infrastructure Technology, and may also affect other Oracle products due to scope change. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts.

The vulnerability allows unauthorized actors to create, delete, or modify critical data within Oracle Hyperion Infrastructure Technology, potentially compromising the confidentiality and integrity of sensitive information. The scope change means other Oracle products may also be impacted. There is no impact on availability. The CVSS score of 9.6 classifies this as a critical security issue.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 addressing this and other vulnerabilities. Customers are strongly advised to apply the available security patches without delay and remain on actively-supported versions. No indication was given that no action is required or that the issue is already mitigated. Patch availability details can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. Since this is not a cloud service, remediation depends on customer patching.