This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. It is easily exploitable by unauthenticated attackers over HTTP, enabling unauthorized access to sensitive data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. The vulnerability is publicly disclosed and assigned CVE-2026-60391. Oracle's August 2026 Critical Security Patch Update advisory references multiple product patches but does not explicitly confirm a patch for this specific version and vulnerability. No known exploits in the wild have been reported.

Successful exploitation results in unauthorized access to critical or all accessible data within Oracle Hyperion Financial Reporting 11.2.25.0.000. This compromises confidentiality but does not affect data integrity or availability. The vulnerability can be exploited remotely without authentication, increasing risk exposure.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to the affected service where possible.