This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure where the product runs. Exploitation can result in complete compromise of the Oracle Hyperion Financial Reporting environment. The CVSS 3.1 base score is 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An attacker with low privileges and logon access to the infrastructure can fully compromise Oracle Hyperion Financial Reporting, potentially leading to takeover of the system. This impacts confidentiality, integrity, and availability of the affected product.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly. The vendor advisory emphasizes staying on actively supported versions and applying patches without delay. No indication of temporary fixes or no-action-required status is provided, so patching is the recommended mitigation.