This vulnerability affects Oracle Hyperion Infrastructure Technology 11.2.25.0.000 and allows unauthenticated remote attackers to compromise the product via HTTP. Exploitation requires user interaction from a third party and can result in unauthorized modification and partial disclosure of accessible data. The vulnerability has a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts without availability impact. Oracle's advisory is part of the August 2026 Critical Security Patch Update, which includes numerous fixes across Oracle products. Customers are urged to apply patches promptly to mitigate risk.

Successful exploitation can lead to unauthorized update, insert, or delete operations on some Oracle Hyperion Infrastructure Technology accessible data and unauthorized read access to a subset of that data. The vulnerability affects confidentiality and integrity but does not impact availability. The attack requires network access via HTTP and user interaction from a person other than the attacker. The scope of impact may extend beyond the Hyperion Infrastructure Technology product to other Oracle products.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers should apply the relevant patches from this update without delay. Oracle strongly recommends staying on actively supported versions and promptly applying security patches to prevent exploitation. No additional mitigation steps are specified beyond patching. Patch status is confirmed by the vendor advisory.