The vulnerability in Oracle Hyperion Financial Reporting allows an unauthenticated attacker with network access via HTTP to fully compromise the application. Successful exploitation can result in a takeover of the system, giving the attacker complete control over data and functionality. The weakness is severe, reflected in a CVSS 3.1 Base Score of 9.8 with impacts to confidentiality, integrity, and availability.

Oracle Corporation’s Hyperion Financial Reporting, specifically the Server component. The affected release is 11.2.25.0.000 and the security alert notes that this version is exposed to the described exploitation.

Because the vulnerability is publicly known and the CVSS score indicates maximum impact, the risk is high. The EPSS score of less than 1% indicates a very low, but non‑zero, likelihood of exploitation; it is not listed in the CISA KEV catalog, and the lack of mitigation information combined with unauthenticated HTTP access makes exploitation feasible if the system remains unpatched. The attack vector is inferred to be via standard HTTP traffic, which is typically accessible from the public or internal network, making the attack feasible and straightforward for an adversary.