This vulnerability affects Oracle Hyperion Infrastructure Technology 11.2.25.0.000 in the Installation and Configuration component. It is easily exploitable remotely without authentication but requires user interaction. The vulnerability has a high impact on confidentiality, integrity, and availability, with a CVSS 3.1 score of 9.6 and scope change indicating potential impact on other Oracle products. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among 943 security patches released. No direct exploit in the wild is reported. Oracle strongly recommends applying the available patches promptly.

Successful exploitation can lead to full takeover of Oracle Hyperion Infrastructure Technology, compromising confidentiality, integrity, and availability. The vulnerability also has scope change, meaning it may significantly impact additional Oracle products beyond Hyperion Infrastructure Technology. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, but requires user interaction, and the vulnerability affects system scope with high impact on all security properties.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the security patches provided in this update without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying all security patches. No alternative mitigations or workarounds are specified in the advisory.