This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An attacker with low privileges and network access via HTTP can exploit this flaw to cause a hang or repeated crash (complete denial of service) and gain unauthorized ability to update, insert, delete, or read a subset of accessible data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impact but high availability impact.

Successful exploitation can lead to denial of service by causing the application to hang or crash repeatedly, and unauthorized access to modify or read some data within Oracle Hyperion Financial Management. This impacts confidentiality, integrity, and availability of the affected system.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. No specific patch link was provided for this product version, so users should consult Oracle's official Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. No indication was given that the vulnerability is already mitigated or requires no action.