This vulnerability affects Oracle Hyperion Infrastructure Technology 11.2.25.0.000 and involves an easily exploitable flaw that allows unauthenticated network attackers to compromise the product via HTTP. Exploitation requires user interaction from a third party. The vulnerability impacts confidentiality and integrity, allowing unauthorized read and modification of accessible data. The vulnerability has a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 others, emphasizing the importance of applying these patches to mitigate risk.

Successful exploitation can result in unauthorized update, insert, or delete operations on some Oracle Hyperion Infrastructure Technology accessible data, as well as unauthorized read access to a subset of that data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that other Oracle products may also be significantly impacted by attacks exploiting this vulnerability.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the relevant patches from this update without delay. Oracle strongly recommends staying on actively supported versions and promptly applying security patches to prevent exploitation. No additional mitigation steps are indicated beyond applying the official patches.