This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP can exploit this flaw to gain unauthorized access to sensitive data or cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle's August 2026 Critical Security Patch Update advisory addresses this vulnerability among many others and strongly recommends applying patches without delay.

Successful exploitation can lead to unauthorized access to critical or all accessible data in Oracle Hyperion Financial Management and can cause a partial denial of service. This compromises confidentiality significantly, with some availability degradation. There is no reported integrity impact. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update including fixes for this vulnerability. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Staying on actively supported versions and applying security patches without delay is recommended. No alternative mitigations or workarounds are specified in the advisory.