This vulnerability affects Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. It allows an unauthenticated attacker with network access over HTTP to compromise the product, resulting in unauthorized read access to a subset of accessible data. The vulnerability is rated with a CVSS 3.1 base score of 3.7, reflecting low severity due to the difficulty of exploitation and limited confidentiality impact. Oracle has acknowledged this issue in their August 2026 Critical Security Patch Update advisory but has not explicitly detailed a standalone patch for this specific vulnerability in the provided advisory content.

Successful exploitation can lead to unauthorized disclosure of some data within Oracle Hyperion Financial Reporting. There is no impact on data integrity or availability. The vulnerability requires network access via HTTP and is difficult to exploit, limiting the overall risk.

Oracle recommends applying the August 2026 Critical Security Patch Update, which includes fixes for this and other vulnerabilities. Customers should remain on actively supported versions and apply security patches promptly. Since the product is not a cloud service, remediation depends on customer patching. Patch status is not explicitly confirmed for this specific vulnerability beyond inclusion in the CSPU; therefore, check the Oracle advisory for the latest patch availability and installation instructions.