This vulnerability affects Oracle Hyperion Infrastructure Technology 11.2.25.0.000 and involves the Common Security component. It is exploitable remotely over HTTP without authentication but requires user interaction. The vulnerability allows unauthorized modification and reading of accessible data, with a scope change potentially impacting additional Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts. Oracle's advisory for the August 2026 Critical Security Patch Update includes this vulnerability among 943 fixes and strongly urges customers to apply patches promptly.

Successful exploitation can result in unauthorized update, insert, or delete operations on some data accessible by Oracle Hyperion Infrastructure Technology, as well as unauthorized read access to a subset of that data. The confidentiality and integrity of the affected system are impacted, but availability is not affected. The vulnerability's scope change means it may affect additional Oracle products beyond Hyperion Infrastructure Technology.

Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches without delay to mitigate this vulnerability. Staying on actively supported versions and promptly applying Oracle patches is recommended. No alternative mitigations or workarounds are specified in the advisory.