This vulnerability affects Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the product by gaining unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of data. Exploitation requires user interaction from a person other than the attacker, and the vulnerability's scope may extend to other Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts with no availability impact.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle Hyperion Financial Reporting. The vulnerability's scope change indicates potential impact on additional Oracle products beyond Hyperion Financial Reporting. The CVSS score of 6.1 reflects a medium severity with confidentiality and integrity impacts but no availability impact.

The vendor advisory does not explicitly state the availability of a patch for this specific vulnerability in the provided content. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay. Users of Oracle Hyperion Financial Reporting version 11.2.25.0.000 should consult the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and remediation information. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.