This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. An unauthenticated attacker with network access via HTTP can exploit this flaw to gain unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, with low confidentiality and integrity impacts and no availability impact. The vulnerability is tracked as CWE-284 (Improper Access Control).

Successful exploitation allows unauthorized modification (update, insert, delete) and unauthorized reading of certain accessible data within Oracle Hyperion Financial Reporting 11.2.25.0.000. This compromises data confidentiality and integrity but does not affect system availability. There are no known exploits in the wild as of the publication date.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory. Customers are strongly recommended to apply the relevant security patches provided by Oracle without delay. Since no explicit patch link for this specific version is provided in the input data, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. Remaining on actively supported versions and timely patching is critical to mitigate this vulnerability.