This vulnerability affects Oracle Hyperion Financial Reporting component Server in version 11.2.25.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. Oracle's August 2026 Critical Security Patch Update advisory includes this fix among 943 security patches and strongly urges customers to apply patches without delay.

Successful exploitation leads to unauthorized access to critical or all data accessible through Oracle Hyperion Financial Reporting 11.2.25.0.000. The confidentiality of sensitive information is compromised, but there is no impact on integrity or availability as per the CVSS vector. This can result in data breaches or exposure of sensitive financial reporting data.

Oracle has released a security patch for this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patch promptly to remediate this vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation.