This vulnerability affects Oracle Hyperion Infrastructure Technology component Common Security in version 11.2.25.0.000. An unauthenticated attacker with network access via HTTP can exploit this flaw, but successful exploitation requires user interaction from a third party. The impact is unauthorized access to critical or all accessible data within the product. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact.

Successful exploitation can lead to unauthorized access to critical or all accessible data in Oracle Hyperion Infrastructure Technology. There is no reported impact on data integrity or system availability. The vulnerability requires user interaction, which limits the ease of exploitation. No known exploits are reported in the wild at this time.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly to remediate this issue. No alternative mitigations or workarounds are specified. Staying on actively supported versions and timely patching are recommended.