This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. It is exploitable remotely over HTTP by an attacker with low privileges, enabling unauthorized access to critical data and partial unauthorized modification capabilities. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which customers are strongly advised to apply promptly.

Successful exploitation can lead to unauthorized access to critical and all accessible data within Oracle Hyperion Infrastructure Technology, as well as unauthorized update, insert, or delete operations on some data. This compromises confidentiality and partially impacts data integrity. There is no reported impact on availability. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit.

Oracle has released a Critical Security Patch Update in August 2026 that includes a fix for this vulnerability. Customers should apply the August 2026 Critical Security Patch Update without delay to remediate this issue. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches. No additional mitigation steps are specified by Oracle beyond applying the official patch.