This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. It permits an unauthenticated attacker with network access over HTTP to compromise the product, resulting in unauthorized read access to a subset of accessible data. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and only confidentiality impact. The vendor advisory is part of Oracle's August 2026 Critical Security Patch Update, which includes many patches across Oracle products.

Successful exploitation allows unauthorized disclosure of some data accessible by Oracle Hyperion Infrastructure Technology 11.2.25.0.000. There is no impact on integrity or availability. The vulnerability is exploitable remotely without authentication, increasing exposure risk. No known exploits in the wild have been reported at this time.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update. Customers should apply the relevant patches from this update to remediate the vulnerability. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Patch availability details are provided in the Oracle advisory. No alternative mitigations or workarounds are specified.