This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. An attacker with low privileges and logon access to the infrastructure where the product runs can exploit this flaw to compromise the product and access critical or all accessible data. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. The vulnerability is listed in Oracle's August 2026 Critical Security Patch Update advisory, which contains numerous patches across Oracle products, but the advisory does not explicitly state if a patch for this version is available.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. The impact is limited to confidentiality with no reported integrity or availability effects. The attack requires local access with low privileges and no user interaction, making it moderately risky in environments where such access is possible.

Oracle's August 2026 Critical Security Patch Update advisory recommends applying security patches without delay and staying on actively supported versions. However, the advisory does not explicitly confirm a patch for Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 for this vulnerability. Therefore, users should consult the official Oracle patch availability documentation linked in the advisory to verify if a patch exists and apply it promptly. Until patched, restrict local access to trusted users only and monitor for unauthorized access attempts.