This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. It is exploitable remotely over HTTP without authentication but requires user interaction from a third party. The impact includes unauthorized access to critical data and limited unauthorized modification capabilities. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. There is no explicit patch link provided in the input data. The vendor advisory references Oracle's August 2026 Critical Security Patch Update, which includes many fixes but does not explicitly confirm a patch for this specific vulnerability in the provided text.

An attacker could gain unauthorized access to critical data or full access to all data accessible by Oracle Hyperion Financial Reporting. Additionally, the attacker could perform unauthorized update, insert, or delete operations on some data. The vulnerability requires human interaction, which reduces the likelihood of exploitation. The overall impact affects confidentiality and integrity but not availability.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. Although no specific patch link is provided for this vulnerability, customers should verify and apply the latest Oracle Critical Security Patch Updates, including the August 2026 update. Since the vulnerability requires user interaction, user awareness and caution with unexpected requests may help reduce risk. Patch status is not yet confirmed explicitly for this vulnerability; check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.