This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw that permits a low privileged attacker with network access over HTTP to cause the application to hang or crash repeatedly, resulting in a complete denial of service. The CVSS 3.1 base score is 5.3, reflecting medium severity with an attack vector of network, high attack complexity, low privileges required, no user interaction, and impact limited to availability. No confidentiality or integrity impacts are reported. The vulnerability is categorized under CWE-284 (Improper Access Control).

Successful exploitation results in unauthorized ability to cause a hang or frequent crashes of Oracle Hyperion Financial Management, leading to a complete denial of service. There is no impact on confidentiality or integrity of data.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update (CSPU) program. However, the provided vendor advisory does not explicitly confirm a patch specifically for this vulnerability version 11.2.25.0.000. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Customers should remain on actively supported versions and apply all relevant security patches without delay.