This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. An attacker with low privileges and logon access to the infrastructure can exploit this flaw to gain unauthorized access and perform unauthorized data manipulation. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. No known exploits in the wild have been reported. Oracle has included this fix in their August 2026 Critical Security Patch Update, which contains numerous security patches across many products. The vendor strongly recommends applying available patches promptly.

Exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Infrastructure Technology, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the system's data but does not impact availability. The attacker requires local logon access with low privileges to the infrastructure where the product runs.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers should apply the relevant patches from this update without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No additional mitigation steps are specified beyond patching.