This vulnerability in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows an unauthenticated attacker to exploit a flaw via HTTP network access to compromise the system. Successful exploitation results in unauthorized access to critical or all accessible data within the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms the attack requires no privileges or user interaction and impacts confidentiality with high severity. The vulnerability is related to the Installation and Configuration component of the product. Oracle has published a Critical Security Patch Update advisory referencing this and many other vulnerabilities but does not explicitly confirm a patch for this specific version in the provided content.

An attacker can gain unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Infrastructure Technology 11.2.25.0.000 without authentication. This compromises confidentiality but does not impact integrity or availability according to the CVSS vector. The vulnerability poses a high risk to organizations using this version of the product.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. However, the provided advisory content does not explicitly confirm a patch for Oracle Hyperion Infrastructure Technology 11.2.25.0.000. Therefore, patch status is not yet confirmed—check the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Until a patch is confirmed and applied, restrict network access to the affected service to trusted users only.