This vulnerability affects Oracle Hyperion Infrastructure Technology component Lifecycle Management in version 11.2.25.0.000. It permits an unauthenticated attacker with network access via HTTP to compromise the system, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has acknowledged this vulnerability in its August 2026 Critical Security Patch Update advisory, which contains numerous security patches across Oracle products. However, no explicit patch or remediation instructions for this specific vulnerability and version are provided in the advisory content excerpt.

Successful exploitation can lead to complete compromise of Oracle Hyperion Infrastructure Technology, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product remotely without authentication.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to remain on actively supported versions and apply Oracle's security patches promptly. Since no specific patch link was provided for this version in the input data, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. Patch status is not yet confirmed explicitly for this version; therefore, verify the vendor advisory for current remediation guidance.