This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. It is difficult to exploit but can be triggered by an unauthenticated attacker over HTTPS. Exploitation results in unauthorized access that may allow creation, deletion, or modification of critical data or full access to all data accessible by the product. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

An attacker exploiting this vulnerability can gain unauthorized access to critical data within Oracle Hyperion Financial Management, including the ability to create, delete, or modify such data. This compromises the confidentiality and integrity of the data but does not affect availability. The impact is significant given the critical nature of financial management data.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No specific patch link was provided in the input, so users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.