This vulnerability affects Oracle Hyperion Infrastructure Technology component Common Events in version 11.2.25.0.000. It is exploitable remotely over HTTP without authentication but requires user interaction from a third party. The vulnerability allows attackers to gain unauthorized access to critical data and perform unauthorized updates, inserts, or deletions of some data. The scope of impact extends beyond the immediate product to additional Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update.

Exploitation can result in unauthorized access to critical data and unauthorized modification of some data within Oracle Hyperion Infrastructure Technology and potentially other related Oracle products due to scope change. The confidentiality impact is high, integrity impact is low, and availability is not affected. The vulnerability requires user interaction but no authentication, making it relatively easy to exploit in a network environment.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. No additional mitigation steps are specified beyond applying the official patch. Users should ensure they are running supported versions and keep their systems updated with Oracle's security patches.