This vulnerability in Oracle Hyperion Infrastructure Technology (version 11.2.25.0.000) permits an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact. The vulnerability is related to the Installation and Configuration component of the product. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability as part of a large set of patches but does not explicitly confirm a patch for this exact version in the provided content.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Hyperion Infrastructure Technology 11.2.25.0.000. There is no impact on integrity or availability reported. The vulnerability allows unauthenticated remote attackers to compromise confidentiality of data accessible through the affected product.

Oracle's August 2026 Critical Security Patch Update advisory recommends applying security patches without delay and remaining on actively supported versions. However, the advisory content provided does not explicitly confirm the availability of a patch for Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. Therefore, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Until a patch is applied, restrict network access to the affected service where possible.