This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. It is difficult to exploit and requires an unauthenticated attacker to have logon access to the infrastructure where the product runs. Additionally, successful exploitation requires human interaction from a third party. The impact includes unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS vector is AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N, reflecting local attack vector, high attack complexity, no privileges required, required user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact.

If exploited, the vulnerability can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Hyperion Infrastructure Technology. This could compromise the confidentiality and integrity of sensitive information managed by the product. However, exploitation is difficult and requires both logon access to the infrastructure and human interaction from a user other than the attacker.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly and remain on actively supported versions. No specific patch link was provided for this vulnerability, but the vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html should be consulted for patch availability and installation instructions. There are no indications that this vulnerability is already mitigated or requires no action.