This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. It permits a low privileged attacker with network access via HTTP to compromise the product, with a scope change that may affect other Oracle products. The CVSS 3.1 base score is 8.2, reflecting high confidentiality and integrity impact but no availability impact. The attack complexity is high, requiring no user interaction but low privileges. Oracle has included this fix in their August 2026 Critical Security Patch Update.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Infrastructure Technology and potentially other Oracle products. This leads to complete loss of confidentiality and integrity of all accessible data. There is no impact on availability. The vulnerability's scope change means that the impact may extend beyond the initially affected product.

Oracle has addressed this vulnerability in their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying patches without delay. No additional mitigation steps are indicated beyond patching.