This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and is related to the security component of the product. It can be exploited remotely without authentication over HTTP, enabling attackers to access sensitive data or cause partial denial of service conditions. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) highlights that the attack requires no privileges or user interaction and impacts confidentiality and availability. Oracle has published a Critical Security Patch Update advisory referencing this vulnerability but does not explicitly state patch availability for this specific version in the provided content.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Hyperion Financial Management and can cause a partial denial of service. The confidentiality impact is high, while integrity is not affected, and availability impact is low.

Oracle strongly recommends applying security patches promptly and staying on actively-supported versions. The vendor advisory references a Critical Security Patch Update released in August 2026 that addresses numerous vulnerabilities across Oracle products. However, the provided advisory content does not explicitly confirm a patch for Oracle Hyperion Financial Management 11.2.25.0.000 for this vulnerability. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.