This vulnerability affects Oracle Hyperion Financial Management component Security in version 11.2.25.0.000. An attacker with high privileges and network access via HTTP can exploit this flaw to compromise the system, leading to unauthorized access to critical or all accessible data and the ability to cause a hang or frequent crashes (complete denial of service). The CVSS vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation can result in unauthorized access to critical or all accessible data in Oracle Hyperion Financial Management and can cause the system to hang or crash repeatedly, leading to a complete denial of service. This impacts confidentiality and availability of the system.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that includes security fixes for this and other vulnerabilities. Customers are strongly advised to apply the available patches promptly and remain on actively-supported versions. No specific patch link was provided for this CVE, so users should consult the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.