This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. It is difficult to exploit and requires network access via HTTP and user interaction from a third party. The vulnerability allows a low privileged attacker to gain unauthorized update, insert, delete, and read access to some data within the affected product. The scope of impact may extend to additional Oracle products. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, user interaction required, scope changed, and low confidentiality and integrity impact with no availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update.

Successful exploitation can result in unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle Hyperion Financial Management. The vulnerability affects confidentiality and integrity but does not impact availability. The attack requires user interaction and is difficult to exploit, limiting the risk. There are no known exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available patches promptly to mitigate the risk. No alternative mitigations or workarounds are specified. Staying on actively supported versions and applying security patches without delay is recommended by Oracle.