This vulnerability affects Oracle Hyperion Infrastructure Technology, specifically version 11.2.25.0.000, within the Installation and Configuration component. It permits a low privileged attacker who has logon access to the infrastructure where the product runs to compromise the system. The attacker can gain unauthorized capabilities to create, delete, or modify critical data or access all data accessible by the product. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory but has not explicitly listed a patch for this specific version or product in the provided advisory content.

The vulnerability allows unauthorized modification and access to critical data within Oracle Hyperion Infrastructure Technology, potentially compromising the confidentiality and integrity of sensitive information. This can lead to unauthorized creation, deletion, or alteration of data, which may affect business operations relying on this data. The attack requires local access with low privileges but no user interaction, making it a significant risk in environments where attackers can gain such access.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. However, the provided advisory content does not explicitly confirm a patch for Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest remediation guidance. Until a patch is applied, restrict local access to the infrastructure hosting Oracle Hyperion Infrastructure Technology to trusted users only.