This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. A high privileged attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical or all accessible data in the system. The CVSS vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. The vulnerability is classified under CWE-284 (Improper Access Control).

Successful exploitation results in unauthorized access to critical or all data accessible by Oracle Hyperion Financial Management, potentially compromising sensitive financial information. There is no reported impact on data integrity or system availability.

Oracle strongly recommends applying the security patches provided in their Critical Security Patch Update (CSPU) for August 2026. Customers should remain on actively-supported versions and apply security patches without delay. Although no specific patch link for this CVE is provided, the vendor advisory indicates that this vulnerability is addressed in the CSPU. Users of Oracle Hyperion Financial Management 11.2.25.0.000 should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.