This vulnerability affects Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the product, but exploitation requires human interaction from a third party. The impact includes unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the product. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, no privileges required, required user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. No known exploits in the wild have been reported. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but strongly recommends applying security patches promptly.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Financial Reporting. This compromises confidentiality and integrity of the data but does not affect availability. The attack requires human interaction, which limits the ease of exploitation.

Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. Although the vendor advisory does not explicitly confirm a patch for this specific vulnerability, it is part of Oracle's Critical Security Patch Update (August 2026) which includes numerous security fixes. Users should consult the Oracle Critical Security Patch Update advisory and apply relevant patches promptly to mitigate this vulnerability.