This vulnerability affects Oracle Hyperion Infrastructure Technology 11.2.25.0.000, specifically in the Installation and Configuration component. It is difficult to exploit but allows an unauthenticated attacker with network access over HTTPS to compromise the system. The impact includes unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within Oracle Hyperion Infrastructure Technology. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality and integrity impacts without availability impact. Oracle's advisory references this vulnerability as part of their August 2026 Critical Security Patch Update, which includes numerous patches across many products.

An attacker who successfully exploits this vulnerability can gain unauthorized creation, deletion, or modification access to critical data or all data accessible by Oracle Hyperion Infrastructure Technology. This results in a high impact on confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability requires network access via HTTPS but no authentication or user interaction, although it is difficult to exploit.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant security patches promptly to mitigate the risk. No specific workaround or temporary fix is stated in the advisory. Staying on actively supported versions and applying Oracle's security patches without delay is the recommended mitigation.