This vulnerability exists in the Common Events component of Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. It is easily exploitable by an attacker with low privileges and network access over HTTP. Successful exploitation can result in unauthorized access to critical or all data accessible by Oracle Hyperion Infrastructure Technology. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no impact on integrity or availability. The vulnerability may also impact additional Oracle products due to scope change. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical or all data accessible through Oracle Hyperion Infrastructure Technology. The confidentiality of sensitive data is at high risk, but integrity and availability are not impacted. The vulnerability's scope change means that other Oracle products may also be affected indirectly.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the relevant patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.