This vulnerability affects Oracle Hyperion Financial Management version 11.2.25.0.000 and involves a security weakness in the product's security component. An attacker with low privileges and logon access to the infrastructure where the product runs can exploit this flaw to gain unauthorized access to critical data or full access to all data accessible by Oracle Hyperion Financial Management. The attacker may also perform unauthorized update, insert, or delete operations on some data. The CVSS vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

The vulnerability allows unauthorized access to critical data and potentially full access to all data accessible by Oracle Hyperion Financial Management. It also permits unauthorized modification of some data through update, insert, or delete operations. This could compromise data confidentiality and integrity within the affected environment.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available security patches promptly to remediate this vulnerability. Oracle recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed by the vendor advisory indicating that this vulnerability is addressed in the Critical Security Patch Update.