This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. It requires a high privileged attacker with local access (logon to the infrastructure) and is difficult to exploit. The impact includes unauthorized modification (update, insert, delete) and unauthorized read access to some data accessible by the product. The CVSS vector indicates local attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts with no availability impact.

An attacker with high privileges and local access to the infrastructure can gain unauthorized read and write access to certain data within Oracle Hyperion Infrastructure Technology. This could lead to data integrity and confidentiality issues but does not affect availability. The overall impact is limited due to the difficulty of exploitation and the requirement for high privileges.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the security patches provided by Oracle promptly. The vendor advisory emphasizes staying on actively supported versions and applying patches without delay. No additional mitigation steps are indicated beyond applying the official patch.