This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. It allows an attacker with low privileges and network access over HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data within Oracle Hyperion Financial Management. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact with no impact on integrity or availability. Oracle has published this vulnerability as part of its August 2026 Critical Security Patch Update.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Hyperion Financial Management 11.2.25.0.000. The confidentiality of sensitive information is at risk, but the vulnerability does not impact data integrity or system availability.

Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.