This vulnerability affects Oracle Hyperion Financial Management component Security in version 11.2.25.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the system and gain unauthorized read access to a subset of accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and limited confidentiality impact without integrity or availability impact. The vulnerability is listed in Oracle's August 2026 Critical Security Patch Update advisory, which contains many patches across Oracle products, but the advisory does not explicitly confirm a patch for this version or vulnerability.

Successful exploitation results in unauthorized read access to some data within Oracle Hyperion Financial Management 11.2.25.0.000. There is no impact on data integrity or availability. The confidentiality impact is limited, and the vulnerability requires network access via HTTP but no authentication or user interaction.

Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among many others but does not explicitly confirm a patch for Oracle Hyperion Financial Management 11.2.25.0.000. Customers are strongly advised to remain on actively supported versions and apply Oracle security patches promptly when available. Patch status for this specific vulnerability is not yet confirmed; check Oracle's official security advisory for current remediation guidance.