This vulnerability in Oracle Hyperion Infrastructure Technology (Common Events component) version 11.2.25.0.000 permits an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on some accessible data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts. The vulnerability is difficult to exploit and has no impact on availability. Oracle has addressed this issue in its August 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of certain data accessible through Oracle Hyperion Infrastructure Technology. The confidentiality and integrity impacts are low, and availability is not affected. The attack requires network access via HTTP and is difficult to exploit due to high attack complexity. No known active exploitation has been reported.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the relevant security patches promptly to remediate this issue. No alternative mitigations or workarounds are specified. Staying on actively supported versions and applying patches without delay is recommended by Oracle.