This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. It permits an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized read access to a subset of accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact without integrity or availability impact. The vulnerability is listed in Oracle's August 2026 Critical Security Patch Update advisory, which contains many patches across Oracle products. However, the advisory does not explicitly state a patch for this specific vulnerability or version.

Successful exploitation allows unauthorized disclosure of some data within Oracle Hyperion Infrastructure Technology 11.2.25.0.000. There is no impact on integrity or availability. The confidentiality impact is limited to a subset of accessible data. No known exploits in the wild have been reported.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory includes many fixes, but it does not explicitly confirm a patch for this vulnerability in version 11.2.25.0.000. Therefore, check Oracle's advisory and patch availability documentation regularly for updates. Until a patch is applied, restrict network access to the affected service to trusted users only.