This vulnerability affects Oracle Hyperion Financial Management component Security in version 11.2.25.0.000. An attacker with low privileges and logon access to the underlying infrastructure can exploit this flaw to gain unauthorized access to sensitive data managed by the product. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact.

Exploitation of this vulnerability can result in unauthorized disclosure of critical data or complete access to all data accessible by Oracle Hyperion Financial Management. There is no reported impact on data integrity or availability. The attack requires local access with low privileges, limiting remote exploitation but still posing a significant risk to confidentiality.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Staying on actively supported versions and timely patching are essential. No indication from the vendor advisory suggests that no action is required or that the issue is already mitigated without patching.