This vulnerability exists in the Installation and Configuration component of Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. An attacker with low privileges and logon access to the infrastructure can exploit this flaw to compromise the Oracle Hyperion Infrastructure Technology environment. The vulnerability has a CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability may also affect other Oracle products due to the scope change.

Successful exploitation allows unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Infrastructure Technology. The confidentiality impact is high, but there is no impact on integrity or availability. The attack requires local access with low privileges and no user interaction. The vulnerability may also affect additional Oracle products beyond Hyperion Infrastructure Technology due to scope change.

Oracle has published this vulnerability as part of its August 2026 Critical Security Patch Update advisory. However, no explicit patch or fix link is provided in the input data. Customers are strongly recommended to remain on actively supported versions and apply Oracle security patches promptly as per Oracle's advisory guidance. Patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation information and patch availability.