This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. It is difficult to exploit and requires the attacker to have low privileged logon access to the infrastructure hosting the product. Exploitation can result in unauthorized creation, deletion, or modification of critical or accessible data, and unauthorized read access to a subset of accessible data. The CVSS vector indicates local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact.

An attacker with low privileged access to the infrastructure can compromise Oracle Hyperion Financial Reporting, leading to unauthorized creation, deletion, or modification of critical or accessible data, and unauthorized read access to some data. This impacts confidentiality and integrity but does not affect availability. The vulnerability is rated medium severity with a CVSS 3.1 score of 5.3.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 which includes security fixes for this vulnerability. Customers are strongly advised to apply the available patches promptly to mitigate this issue. The vendor advisory does not indicate that no action is required or that the vulnerability is already mitigated without patching. Therefore, applying the official Oracle patch for version 11.2.25.0.000 is the recommended remediation.