This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An attacker with low privileges and network access via HTTP can exploit this vulnerability, but successful exploitation requires human interaction from someone other than the attacker. The vulnerability can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on some data. The vulnerability has a scope change, meaning it may affect other Oracle products beyond Hyperion Financial Management. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

Exploitation of this vulnerability can result in unauthorized access to critical data within Oracle Hyperion Financial Management and unauthorized modification (update, insert, delete) of some accessible data. The scope change indicates that additional Oracle products may also be impacted. The confidentiality impact is high, integrity impact is low, and availability is not affected. The vulnerability requires user interaction from a third party, which may limit exploitation scenarios.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches without delay to mitigate this vulnerability. The vendor advisory emphasizes the importance of staying on actively supported versions and promptly applying patches. No indication was given that no action is required or that the vulnerability is already mitigated without patching.