This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. It is easily exploitable remotely without authentication over HTTP, enabling attackers to compromise the system fully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 fixes and urges customers to apply patches without delay to mitigate exploitation risks.

An unauthenticated attacker with network access can exploit this vulnerability to take over Oracle Hyperion Financial Reporting version 11.2.25.0.000. This results in complete compromise of confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported yet, but the critical severity and ease of exploitation make this a significant risk if unpatched.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability along with many others. Customers should apply the official patches provided by Oracle promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. Patch availability and installation instructions are detailed in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.