A local attacker with low privileges who can log on to the infrastructure where Oracle Hyperion Infrastructure Technology runs can exploit a flaw in the installation and configuration component. The vulnerability permits unauthorized creation, deletion, or modification of access controls and critical data, compromising confidentiality and integrity. Successful exploitation leads to the attacker gaining the ability to alter, delete, or create data accessible through the product.

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000, as released by Oracle Corporation.

The CVSS v3.1 base score of 7.1 indicates high severity, with the attack vector defined as local, and low attack complexity and prerequisites. The EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the vulnerability has not been flagged in CISA’s KEV catalog. The attacker requires a low‑privileged account with permission to execute the affected component and can then elevate privileges within the product to manipulate critical data.