This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. It allows a low privileged attacker with network access via HTTP to exploit the system, but requires user interaction from a third party. The impact includes unauthorized access to critical data and limited unauthorized modification capabilities. The CVSS vector is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Financial Reporting. Additionally, it can allow unauthorized update, insert, or delete access to some of the accessible data. The vulnerability does not impact availability. The attack requires human interaction from a user other than the attacker, which limits the ease of exploitation.

Oracle strongly recommends applying security patches without delay. However, the provided vendor advisory does not explicitly confirm a patch availability for this specific vulnerability. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Customers should remain on actively-supported versions and apply all relevant security updates promptly.