This vulnerability exists in the Installation and Configuration component of Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. It is easily exploitable by an attacker with low privileges who has network access via HTTP. Successful exploitation can result in complete compromise of the affected Oracle Hyperion Infrastructure Technology instance. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes numerous security patches across Oracle products.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to fully compromise Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. This includes complete takeover of the affected system, impacting confidentiality, integrity, and availability of the product.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to prevent exploitation. No additional mitigation steps are specified beyond applying the official patch.