This vulnerability affects Oracle Hyperion Infrastructure Technology component Installation and Configuration in version 11.2.25.0.000. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the system. The impact includes unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the product. The CVSS vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Infrastructure Technology. This compromises confidentiality and integrity of the data but does not affect availability.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available security patches without delay to mitigate this vulnerability. The vendor advisory emphasizes staying on actively supported versions and promptly applying patches. Patch availability details should be checked in the Oracle Critical Security Patch Update documentation. No specific patch link was provided in the input, so users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch installation instructions.