This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and allows unauthenticated remote attackers to exploit the product over TLS to gain unauthorized access and perform critical data manipulation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, with a scope change and high confidentiality and integrity impacts but no availability impact. The vulnerability is part of Oracle's security component in Hyperion and may impact other Oracle products as well. Oracle's August 2026 Critical Security Patch Update advisory includes fixes for this vulnerability among 943 patches.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, compromising confidentiality and integrity of all accessible data. The vulnerability allows full compromise without authentication or user interaction, making it highly dangerous. The scope change indicates potential impact on additional Oracle products beyond Hyperion Financial Management.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the relevant patches from this update promptly to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are indicated in the advisory.