This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and is classified under the Security component. It allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within Oracle Hyperion Financial Management. The CVSS 3.1 base score is 8.1, indicating high severity, with attack vector network, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts but no availability impact.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Hyperion Financial Management. This compromises the confidentiality and integrity of sensitive financial data managed by the product. There is no indication of availability impact. No known exploits in the wild have been reported as of the publication date.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the latest security patches promptly and remain on actively supported versions. The vendor advisory does not explicitly confirm patch availability for version 11.2.25.0.000 but recommends applying available patches without delay. Patch status for this specific version is not explicitly confirmed; users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.