This vulnerability affects Oracle Hyperion Infrastructure Technology 11.2.25.0.000 in the Installation and Configuration component. An attacker with low privileges and logon access to the infrastructure where the product runs can exploit this flaw to gain unauthorized access and perform critical data modifications or deletions. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires local access with low complexity and privileges but no user interaction, resulting in high confidentiality and integrity impacts without affecting availability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Infrastructure Technology. The attacker may gain complete access to all data accessible by the product, compromising confidentiality and integrity. There is no reported impact on availability. No known exploits are reported in the wild at this time.

Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory. However, no specific patch link or fixed version is provided in the input data. Customers are strongly advised to consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and apply security patches promptly. Patch status is not yet confirmed from the provided data; therefore, verify the vendor advisory for current remediation guidance.