This vulnerability affects Oracle Hyperion Infrastructure Technology 11.2.25.0.000, specifically in the Installation and Configuration component. An attacker with low privileges and network access via HTTP could exploit this flaw to gain unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts with no availability impact.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible by Oracle Hyperion Infrastructure Technology. The impact is limited to confidentiality and integrity with no impact on availability. The vulnerability is considered medium severity based on the CVSS score of 4.2.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. No indication was given that the vulnerability is already mitigated or requires no action. Patch availability is confirmed by the vendor advisory. The affected version is 11.2.25.0.000, so upgrading to a patched version or applying the CSPU is recommended.