This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. An attacker with low privileges and logon access to the infrastructure can exploit this flaw to read unauthorized subsets of data accessible by the product. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact. Oracle has addressed this issue in its August 2026 Critical Security Patch Update, which contains targeted security fixes for this and other vulnerabilities.

Successful exploitation results in unauthorized read access to a subset of data accessible by Oracle Hyperion Infrastructure Technology. There is no impact on data integrity or availability. The vulnerability requires local access with low privileges, limiting the attack surface. The overall severity is low.

Oracle has released a fix for this vulnerability in the August 2026 Critical Security Patch Update. Customers should apply the relevant patches promptly to remediate this issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated by the vendor advisory.