This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An attacker with low privileges and network access via HTTP can exploit this flaw to access sensitive data without authorization or cause a partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability is tracked as CWE-284 (Improper Access Control).

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Hyperion Financial Management and can cause a partial denial of service affecting availability. The confidentiality impact is high, while availability impact is low. There is no impact on integrity.

Oracle has released security patches as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this vulnerability. The vendor advisory emphasizes staying on actively supported versions and applying patches without delay. No indication of temporary fixes or workarounds is provided, so patching is the recommended mitigation.