This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. It is difficult to exploit but allows an unauthenticated attacker with network access over TLS to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data and unauthorized modification of some data. The CVSS vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation can result in unauthorized access to critical or all accessible data within Oracle Hyperion Infrastructure Technology and unauthorized update, insert, or delete access to some data. This compromises confidentiality and integrity of the data but does not affect availability.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available security patches promptly to remediate this vulnerability. No indication was found that the vulnerability is already mitigated or requires no action. Patch availability is implied by the vendor advisory referencing the Critical Security Patch Update. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch details and installation instructions.