This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and allows unauthenticated remote attackers to compromise the system via HTTP network access. Exploitation can lead to unauthorized modification (update, insert, delete) of some accessible data and partial denial of service conditions. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on integrity and availability but not confidentiality. Oracle has acknowledged this vulnerability and included it in the August 2026 Critical Security Patch Update advisory.

Successful exploitation can result in unauthorized modification of accessible data within Oracle Hyperion Financial Management and partial denial of service, potentially disrupting availability. There is no impact on confidentiality according to the CVSS vector. The vulnerability is exploitable remotely without authentication, increasing risk if the system is exposed to untrusted networks.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. No specific temporary workarounds or mitigations are indicated in the advisory. Maintaining up-to-date patched versions is the recommended course of action.