This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 in the security component. It permits a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory, which contains numerous patches across products. However, the vendor advisory does not explicitly confirm patch availability for this specific vulnerability, so patch status is not yet confirmed.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Hyperion Financial Management 11.2.25.0.000. There is no impact on data integrity or system availability. The attack requires network access via HTTP and low privileges but is difficult to exploit.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. Although the advisory does not explicitly confirm a patch for this specific vulnerability, customers should review the August 2026 Critical Security Patch Update documentation and apply relevant patches for Oracle Hyperion Financial Management 11.2.25.0.000. Maintaining actively-supported versions and timely patching is critical to mitigate this vulnerability.