This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. It requires the attacker to have physical access to the communication segment connected to the hardware where the software executes, making exploitation difficult. If exploited, it can result in unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Hyperion Financial Reporting. The CVSS vector indicates attack vector as adjacent network (AV:A), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality and integrity impacts (C:H/I:H) with no availability impact (A:N). No known exploits in the wild have been reported. The vendor advisory does not explicitly mention a patch for this specific vulnerability but references a Critical Security Patch Update released in August 2026 containing numerous fixes. The affected version is explicitly stated as 11.2.25.0.000.

An attacker with physical access to the communication segment can compromise Oracle Hyperion Financial Reporting, leading to unauthorized creation, deletion, or modification of critical data. This compromises confidentiality and integrity of the data but does not affect availability. The impact is significant for data security within the affected system.

Oracle strongly recommends applying the latest Critical Security Patch Update released in August 2026, which includes numerous security fixes. Customers should remain on actively supported versions and apply security patches without delay. Since the vulnerability requires physical access to the communication segment, limiting such access can also reduce risk. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, check the vendor advisory for current remediation guidance.