This vulnerability affects the Oracle Hyperion Financial Reporting product, specifically version 11.2.25.0.000. It is exploitable remotely over HTTP without authentication but is considered difficult to exploit. Successful exploitation can lead to unauthorized access to critical or all accessible data and unauthorized modification (update, insert, delete) of some data. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. There is no explicit vendor advisory stating a patch for this specific vulnerability, but Oracle's August 2026 Critical Security Patch Update advisory recommends applying security patches promptly to mitigate vulnerabilities.

An attacker exploiting this vulnerability could gain unauthorized access to sensitive or critical data within Oracle Hyperion Financial Reporting and could modify some of that data without authorization. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability. The vulnerability requires network access via HTTP and is difficult to exploit, which somewhat limits the risk.

Oracle strongly recommends applying the latest security patches as provided in their Critical Security Patch Update (CSPU) advisories. Although no specific patch link is provided for this vulnerability, customers should ensure they are running actively supported versions and apply all relevant Oracle patches without delay. Patch status is not explicitly confirmed for this vulnerability; therefore, check Oracle's official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.