This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and is related to the security component of the product. It is easily exploitable by an attacker with low privileges who has network access and can execute SQL commands. Successful exploitation can result in complete compromise of the Oracle Hyperion Financial Management system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes targeted high-priority fixes.

The vulnerability allows an attacker with low privileges and network access to execute SQL-based attacks that can lead to full takeover of the Oracle Hyperion Financial Management system. This compromises confidentiality, integrity, and availability of the affected product, potentially allowing unauthorized data access, modification, or denial of service.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.