This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. It allows a low privileged attacker who already has logon access to the infrastructure where the product runs to compromise the product and access critical or all accessible data. The CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact. Oracle has published this vulnerability as part of its August 2026 Critical Security Patch Update, which includes 943 security patches across various products.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Infrastructure Technology. The confidentiality impact is high, but integrity and availability are not affected. The attack requires local access with low privileges and no user interaction.

Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying patches without delay. No additional mitigation steps are specified beyond applying the official patch.