This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the system, requiring user interaction from a third party. The impact includes unauthorized modification (update, insert, delete) and unauthorized read access to some data within Oracle Hyperion Financial Reporting. The vulnerability has a CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impacts with no availability impact. Oracle's advisory references a Critical Security Patch Update for August 2026 covering many products but does not explicitly confirm a patch for this version or vulnerability in the provided content.

Successful exploitation can result in unauthorized update, insert, or delete access to some Oracle Hyperion Financial Reporting accessible data and unauthorized read access to a subset of that data. The vulnerability affects confidentiality and integrity but does not impact availability. The attack requires user interaction from a person other than the attacker and can affect additional Oracle products beyond Hyperion Financial Reporting due to scope change.

Oracle has released a Critical Security Patch Update in August 2026 that addresses numerous vulnerabilities across Oracle products. Customers are strongly advised to remain on actively supported versions and apply Oracle security patches promptly. However, the input data does not explicitly confirm a patch for Oracle Hyperion Financial Reporting version 11.2.25.0.000 for this specific vulnerability. Therefore, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Until a patch is applied, users should be aware that exploitation requires user interaction and network access via HTTP.