This vulnerability affects Oracle Hyperion Financial Management version 11.2.25.0.000 and involves a security flaw in the product's security component. It can be exploited remotely over the network via HTTP by an attacker with low privileges, leading to unauthorized access to sensitive data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact with no impact on integrity or availability. The vendor advisory references Oracle's August 2026 Critical Security Patch Update but does not explicitly confirm a patch for this specific vulnerability or version. Customers are urged to stay on supported versions and apply patches promptly.

Successful exploitation can result in unauthorized access to critical or all data accessible by Oracle Hyperion Financial Management 11.2.25.0.000. The confidentiality of data is severely impacted, but there is no impact on data integrity or availability. This could lead to data exposure risks within affected environments.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Oracle recommends customers remain on actively-supported versions and apply security patches without delay. No specific patch or temporary fix for this vulnerability and version is explicitly stated in the advisory.