This vulnerability in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 involves a flaw in the Installation and Configuration component that can be exploited by a low privileged attacker who has logon access to the infrastructure where the product runs. Successful exploitation can result in unauthorized access to critical or all data accessible by Oracle Hyperion Infrastructure Technology. The CVSS 3.1 vector indicates local attack vector (AV:L), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and a high confidentiality impact (C:H) with no impact on integrity or availability.

The vulnerability allows unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Infrastructure Technology. This compromises confidentiality but does not affect integrity or availability. Exploitation requires local access with valid logon credentials and is difficult due to high attack complexity.

Oracle strongly recommends applying the security patches provided in their Critical Security Patch Update (CSPU) for August 2026. Customers should remain on actively supported versions and apply available patches without delay to mitigate this vulnerability. Patch availability is documented in Oracle's advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No indication exists that the vulnerability is already mitigated or requires no action.