This vulnerability exists in the security component of Oracle Hyperion Financial Management version 11.2.25.0.000. It is easily exploitable by an attacker with low privileges and network access using SQL, enabling compromise of the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle’s August 2026 Critical Security Patch Update advisory references this vulnerability as part of a broad set of patches but does not explicitly confirm a patch for this version or provide a fixed version number.

Successful exploitation can lead to complete takeover of Oracle Hyperion Financial Management, impacting confidentiality, integrity, and availability of the system. This could allow attackers to access sensitive financial data, alter information, or disrupt service operations.

Oracle strongly recommends applying the August 2026 Critical Security Patch Update promptly to address this and other vulnerabilities. Customers should ensure they are running actively supported versions and apply all relevant patches without delay. Since no explicit patch link or fixed version is provided for this vulnerability, users should monitor Oracle’s advisory for updates and apply any forthcoming patches targeting Oracle Hyperion Financial Management 11.2.25.0.000.