This vulnerability affects Oracle Hyperion Financial Management component Security in version 11.2.25.0.000. It is easily exploitable by an attacker with low privileges and network access via SQL, enabling compromise of the system. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory, which contains multiple patches across products. However, no explicit patch link or fixed version for this specific vulnerability is provided in the input data.

The vulnerability allows an attacker with network access and low privileges to execute SQL-based attacks that can lead to complete takeover of Oracle Hyperion Financial Management. This compromises confidentiality, integrity, and availability of the system, potentially allowing unauthorized data access, modification, and denial of service.

Oracle has released a Critical Security Patch Update in August 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the relevant patches promptly to mitigate this vulnerability. Since no specific patch link is provided, users should consult the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. Remaining on actively-supported versions and applying security patches without delay is recommended.