This vulnerability affects the Oracle Hyperion Financial Reporting product, specifically version 11.2.25.0.000. It is exploitable remotely over HTTP without authentication but requires user interaction from a third party. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impacts but no availability impact. The vulnerability enables unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. Oracle has published a Critical Security Patch Update advisory referencing this vulnerability, emphasizing the importance of applying patches promptly. However, no explicit patch link or fixed version is provided in the input data.

An attacker can remotely exploit this vulnerability without authentication but requires a user to interact to trigger the attack. The impact includes unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Hyperion Financial Reporting. This compromises confidentiality and integrity of sensitive financial reporting data, potentially leading to significant business impact.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update (CSPU) program. Although no direct patch link or fixed version is provided in the input, the vendor advisory indicates that patches addressing this vulnerability are included in the August 2026 CSPU. Organizations should review the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html and apply the relevant patches without delay. No indication was given that the vulnerability is already mitigated or requires no action.