This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and allows a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information). Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others and urges customers to apply patches without delay.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Financial Management. The impact is limited to confidentiality with no direct impact on integrity or availability. The vulnerability requires high privileges and network access via HTTP.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches from this update promptly to remediate the vulnerability. No indication was given that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, remediation depends on customer patching.