This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. An unauthenticated attacker who already has logon access to the infrastructure can exploit this flaw to compromise the product and obtain unauthorized read access to a subset of data accessible by Oracle Hyperion Infrastructure Technology. The CVSS vector indicates low attack complexity and no privileges required, but local attack vector (AV:L) means the attacker must have local access. The impact is limited to confidentiality with no integrity or availability impact. Oracle's August 2026 Critical Security Patch Update advisory mentions many patches but does not explicitly confirm a fix for this vulnerability in the provided excerpt.

Successful exploitation results in unauthorized read access to some data accessible by Oracle Hyperion Infrastructure Technology, potentially exposing sensitive information. There is no reported impact on data integrity or system availability. The attack requires the attacker to have logon access to the infrastructure where the product runs, limiting the attack surface to insiders or those with some level of access.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Updates. However, the provided advisory content does not explicitly confirm a patch for this vulnerability or state that no action is required. Therefore, users should consult the Oracle Critical Security Patch Update for August 2026 and subsequent advisories to verify patch availability and apply updates accordingly. Until patched, restrict logon access to trusted users only.