This vulnerability affects Oracle Hyperion Infrastructure Technology, specifically version 11.2.25.0.000. It is exploitable by an attacker with low privileges who has network access via HTTP. The attacker can perform unauthorized actions on critical data, including creation, deletion, or modification, and can also cause the system to hang or crash repeatedly, resulting in a complete denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, highlighting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. The vulnerability is identified as CWE-284 (Improper Access Control).

An attacker with network access and low privileges can exploit this vulnerability to gain unauthorized ability to create, delete, or modify critical data within Oracle Hyperion Infrastructure Technology. Additionally, the attacker can cause the product to hang or crash frequently, resulting in a denial of service condition. There is no confidentiality impact reported. The overall impact affects data integrity and system availability.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes remaining on actively-supported versions and applying patches without delay. Patch availability details can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No indication is given that the vulnerability is already mitigated or requires no action.