This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. It is easily exploitable remotely without authentication over HTTP. Successful exploitation can lead to unauthorized modification (update, insert, delete) of some accessible data, unauthorized read access to a subset of data, and partial denial of service conditions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. The vendor advisory linked is a general Critical Security Patch Update for August 2026, listing many products but does not explicitly confirm a patch or remediation for this exact vulnerability or version. Patch status is therefore not yet confirmed.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized read and write access to some data within Oracle Hyperion Infrastructure Technology 11.2.25.0.000, potentially compromising confidentiality and integrity. Additionally, the attacker can cause a partial denial of service, impacting availability. This could disrupt normal operations and lead to data manipulation or leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle strongly recommends applying security patches promptly once they become available and remaining on actively-supported versions. Until a patch is confirmed, restrict network access to Oracle Hyperion Infrastructure Technology instances where possible and monitor for unusual activity.