This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An attacker who can log on to the underlying infrastructure but does not have authentication within the application can exploit this flaw to read a subset of data accessible by Oracle Hyperion Financial Management. The CVSS vector indicates low attack complexity and no privileges required, but local attack vector (AV:L) is necessary. The impact is limited to confidentiality with no impact on integrity or availability.

Successful exploitation results in unauthorized read access to a subset of data accessible by Oracle Hyperion Financial Management. There is no impact on data integrity or system availability. The attack requires the attacker to have logon access to the infrastructure where the product executes, but no further privileges or user interaction are needed.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that includes fixes for this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate this issue. Staying on actively supported versions and applying Oracle's security patches without delay is recommended. Patch availability for this specific version is confirmed in the Oracle advisory. No alternative mitigations or workarounds are specified.