This vulnerability affects Oracle Hyperion Infrastructure Technology component Common Security in version 11.2.25.0.000. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in unauthorized access to critical data and unauthorized modification of some data. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update advisory.

Successful exploitation can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some data within Oracle Hyperion Infrastructure Technology. The vulnerability affects confidentiality and integrity but does not impact availability. The attack complexity is high, and a low privileged attacker with network access is required. There are no known exploits in the wild at this time.

Oracle has released a security patch for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are specified beyond applying the official patch.