This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. It allows a high privileged attacker with network access via SQL to perform unauthorized actions on critical data, including creation, deletion, or modification. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle has acknowledged this vulnerability in their August 2026 Critical Security Patch Update advisory but has not explicitly provided a direct patch link for this specific CVE in the input data.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Infrastructure Technology. This compromises confidentiality and integrity of the data. There is no impact on availability. The attacker must have high privileges and network access to exploit this vulnerability.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory. Customers are strongly recommended to apply the relevant security patches from this update promptly. Since the product is not a cloud service, remediation requires applying Oracle's patches. Patch status is not explicitly confirmed for this specific CVE in the advisory content provided; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current patch availability and installation instructions.