This vulnerability affects Oracle Hyperion Financial Management component Security in version 11.2.25.0.000. It allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized access to sensitive data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes targeted high-priority fixes. The vendor strongly recommends applying patches without delay to prevent exploitation.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Hyperion Financial Management. The confidentiality of sensitive information is compromised, but there is no impact on data integrity or system availability. The vulnerability can be exploited remotely over the network with low privileges and no user interaction required.

Oracle has released a Critical Security Patch Update in August 2026 that includes a fix for this vulnerability. Customers should apply the official patch promptly to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated by the vendor advisory.