This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. It enables a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly state a dedicated patch for this version or vulnerability in the provided content.

Successful exploitation can lead to unauthorized access to critical or all accessible data in Oracle Hyperion Financial Management 11.2.25.0.000. The impact is limited to confidentiality with no reported integrity or availability effects. The vulnerability is exploitable by an attacker with low privileges over the network via HTTP, increasing the risk of data compromise.

Oracle strongly recommends applying security patches without delay as part of their Critical Security Patch Update program. However, the provided advisory content does not explicitly confirm a patch for this specific vulnerability and version. Customers should consult the Oracle Critical Security Patch Update advisory and related patch availability documentation to verify if a patch is available for Oracle Hyperion Financial Management 11.2.25.0.000 and apply it promptly. Maintaining actively supported versions and timely patching remain the primary mitigation strategy.