This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw that can be exploited remotely over HTTP by an attacker with low privileges. Successful exploitation can lead to unauthorized access to critical or all accessible data within the product. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact with no integrity or availability impact.

An attacker with network access and low privileges can exploit this vulnerability to gain unauthorized access to sensitive data managed by Oracle Hyperion Financial Management. There is no impact on data integrity or system availability. The confidentiality impact is high, potentially exposing critical data to unauthorized parties.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. The vendor advisory emphasizes staying on actively supported versions and applying security patches without delay. Patch availability for this specific version should be confirmed via the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.