This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access over HTTP can exploit this vulnerability, but it requires user interaction from a third party. The impact includes unauthorized modification of accessible data (update, insert, delete) and the ability to cause a partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) reflects network attack vector, high attack complexity, no privileges required, required user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

The vulnerability can lead to unauthorized modification of some accessible data within Oracle Hyperion Financial Management and partial denial of service conditions. There is no confidentiality impact reported. The attack requires network access and user interaction, limiting the ease of exploitation. The overall impact is medium severity affecting data integrity and system availability.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. No indication from the vendor advisory suggests that no action is required or that the issue is already mitigated without patching. Therefore, applying the official Oracle patch for version 11.2.25.0.000 is the recommended remediation.