This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An attacker with low privileges and network access via HTTP can exploit this vulnerability to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Hyperion Financial Management 11.2.25.0.000. There is no reported impact on data integrity or system availability.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches provided by Oracle promptly. The vendor advisory emphasizes staying on actively supported versions and applying security patches without delay to mitigate exploitation risks. Patch availability details are provided in the Oracle advisory linked in the source. No indication of temporary or alternative mitigations is provided, so patching is the recommended action.