This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and is related to the security component. It allows an attacker with low privileges and network access over HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data within Oracle Hyperion Financial Management. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which contains targeted security fixes across multiple Oracle products.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Financial Management. This compromises confidentiality but does not affect integrity or availability. The vulnerability also has potential to impact additional Oracle products due to scope change.

Oracle has released a security patch for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply this patch promptly to mitigate the vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.