This vulnerability affects Oracle Hyperion Infrastructure Technology component Common Events in version 11.2.25.0.000. It is easily exploitable by an attacker with low privileges and network access via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vulnerability is tracked as CWE-284 (Improper Access Control). Oracle's August 2026 Critical Security Patch Update advisory mentions this vulnerability but does not explicitly state patch availability or remediation steps for this version in the provided excerpt.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data, including the ability to create, delete, or modify such data within Oracle Hyperion Infrastructure Technology 11.2.25.0.000. This compromises the confidentiality and integrity of the data but does not impact system availability.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory references this vulnerability as part of a broader set of fixes. However, the provided advisory content does not explicitly confirm patch availability or provide specific remediation instructions for Oracle Hyperion Infrastructure Technology 11.2.25.0.000. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and remediation information. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.