This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the system, potentially leading to full takeover. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others and strongly recommends applying patches promptly to mitigate exploitation risks.

Successful exploitation can result in complete compromise of Oracle Hyperion Financial Reporting, affecting confidentiality, integrity, and availability of the system. The vulnerability is rated high severity with a CVSS score of 8.1. There are no known exploits in the wild at this time.

Oracle recommends applying the security patches provided in the August 2026 Critical Security Patch Update. Customers should remain on actively supported versions and apply patches without delay. Since no direct patch link is provided for this specific version in the advisory, users must consult Oracle's official patch availability documentation to obtain and apply the relevant fixes. No indication is given that the vulnerability is already mitigated or requires no action.