This vulnerability in the Common Events component of Oracle Hyperion Infrastructure Technology (version 11.2.25.0.000) enables a low privileged attacker with network access via HTTP to compromise the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Successful exploitation can result in full takeover of the affected Oracle Hyperion Infrastructure Technology instance. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 security fixes and strongly recommends applying patches without delay.

The vulnerability can lead to complete compromise of Oracle Hyperion Infrastructure Technology, affecting confidentiality, integrity, and availability of the system. This means an attacker could gain unauthorized access and control over the affected product, potentially disrupting business operations and exposing sensitive data.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No additional mitigations or workarounds are specified in the advisory.