This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 in the security component. It allows a low privileged attacker with network access via HTTP to compromise the system, potentially resulting in complete takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-284 (Improper Access Control).

Successful exploitation can lead to full compromise of Oracle Hyperion Financial Management, impacting confidentiality, integrity, and availability of the system. This means an attacker could gain unauthorized access and control over the affected system.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly. The vendor advisory emphasizes staying on actively supported versions and applying patches without delay. No specific patch link for this product version was provided in the input, so users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.