This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP can exploit this vulnerability, but exploitation requires user interaction from a third party. Successful exploitation can result in unauthorized read access and unauthorized modification (update, insert, delete) of some accessible data within the product. The CVSS 3.1 base score is 5.4, reflecting low confidentiality and integrity impacts and no availability impact. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. The vulnerability is associated with CWE-352 (Cross-Site Request Forgery).

The vulnerability allows unauthorized actors to read and modify some data in Oracle Hyperion Financial Management without authentication, provided they can trick a legitimate user into interacting with a crafted HTTP request. This could lead to unauthorized data disclosure and unauthorized data changes, potentially impacting data integrity and confidentiality within the affected system.

Oracle strongly recommends applying the relevant security patches provided in their Critical Security Patch Update (CSPU) for August 2026. Customers should remain on actively-supported versions and apply security patches without delay to mitigate this vulnerability. The vendor advisory does not indicate that the vulnerability is already mitigated or requires no action. Since no direct patch link was provided in the input, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.