This vulnerability affects the Oracle Hyperion Financial Reporting server component, specifically version 11.2.25.0.000. It is easily exploitable by unauthenticated attackers over HTTPS, enabling unauthorized access to sensitive data and partial denial of service conditions. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low availability impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability within a broad set of patches but does not explicitly state patch availability or remediation details for this version. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized access to critical or all data accessible via Oracle Hyperion Financial Reporting and can cause a partial denial of service. This compromises confidentiality and availability of the affected system. There is no reported impact on integrity. The vulnerability is exploitable remotely without authentication, increasing risk.

Oracle strongly recommends applying the latest Critical Security Patch Update released in August 2026, which addresses numerous vulnerabilities including this one. Customers should ensure they are running actively supported versions and apply security patches without delay. Since the vendor advisory does not explicitly confirm patch availability for this specific version, users should consult the Oracle advisory and patch availability documentation for Oracle Hyperion Financial Reporting 11.2.25.0.000 to confirm remediation steps. No alternative mitigations or workarounds are provided in the advisory.