This vulnerability affects Oracle Hyperion Infrastructure Technology 11.2.25.0.000, specifically in the Installation and Configuration component. An attacker with high privileges and logon access to the infrastructure can exploit this flaw to compromise the product by unauthorized modification of some accessible data and causing a partial denial of service. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) reflects local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation allows unauthorized update, insert, or delete access to some data within Oracle Hyperion Infrastructure Technology and the ability to cause a partial denial of service. There is no confidentiality impact. The overall severity is low based on the CVSS score of 3.4.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 covering multiple products. Customers are strongly advised to apply the relevant security patches promptly. Since the vendor advisory references a CSPU containing numerous fixes, users of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 should apply the August 2026 CSPU to remediate this vulnerability. No indication is given that the vulnerability is already mitigated or requires no action.