This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP can exploit this flaw to gain unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The vulnerability has a CVSS 3.1 base score of 4.8, indicating medium severity, with confidentiality and integrity impacts but no availability impact. The attack complexity is high, and no privileges or user interaction are required. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes numerous patches for various Oracle products.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of certain data within Oracle Hyperion Financial Management 11.2.25.0.000. This compromises the confidentiality and integrity of the affected data but does not affect availability. The vulnerability requires network access via HTTP and is difficult to exploit.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.