This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An attacker with low privileges and network access via HTTP can exploit this flaw to compromise the system, resulting in unauthorized access to sensitive data. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact with no integrity or availability impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for this version in the provided excerpt.

Successful exploitation can lead to unauthorized access to critical or all data accessible through Oracle Hyperion Financial Management 11.2.25.0.000. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector. The attacker requires only low privileges and network access via HTTP, making the vulnerability relatively easy to exploit.

Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory includes this vulnerability, implying that a patch or fix is available as part of Oracle's security updates. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions specific to Oracle Hyperion Financial Management 11.2.25.0.000. No vendor advisory states that no action is required or that the issue is already mitigated.