This vulnerability in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, required low privileges, no user interaction, unchanged scope, and high confidentiality impact without affecting integrity or availability. The vulnerability is related to the Installation and Configuration component of the product. Oracle has published a Critical Security Patch Update in August 2026 addressing this and many other vulnerabilities, recommending customers apply patches promptly.

Successful exploitation allows unauthorized access to critical or all accessible data within Oracle Hyperion Infrastructure Technology 11.2.25.0.000. There is no impact on data integrity or availability. The attacker requires low privileges and network access via HTTP to exploit this vulnerability.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update that address this vulnerability. Customers are strongly advised to apply the available patches without delay to remediate this issue. No indication exists that the vulnerability is already mitigated or requires no action. Patch status is confirmed by the vendor advisory. Since this is not a cloud service, remediation depends on customer patching.