This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. It permits a low privileged attacker who has logon access to the infrastructure hosting the application to compromise the software, resulting in unauthorized modification of critical or accessible data. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N, indicating local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but high integrity impact. No known exploits are reported in the wild. Oracle has included this vulnerability in their August 2026 Critical Security Patch Update advisory but no explicit patch link or version fix is provided in the input data.

The impact is unauthorized modification of critical or accessible data within Oracle Hyperion Financial Reporting. There is no confidentiality or availability impact reported. The vulnerability requires local access with low privileges and is difficult to exploit due to high attack complexity. Successful exploitation could compromise data integrity within the affected application.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. However, the provided data does not explicitly confirm a patch for this specific vulnerability version 11.2.25.0.000. Customers should consult the Oracle August 2026 Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Until patched, restrict local access to the infrastructure hosting Oracle Hyperion Financial Reporting to trusted users only.