This vulnerability affects Oracle Hyperion Financial Management (component: Security) in version 11.2.25.0.000. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure hosting the product. Exploitation can result in unauthorized creation, deletion, or modification of critical data, with a scope change that may affect other Oracle products. The CVSS 3.1 base score is 8.4, reflecting high confidentiality and integrity impacts without availability impact. The attack vector is local (AV:L), with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N). The vulnerability is classified under CWE-284 (Improper Access Control).

Successful exploitation allows unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, compromising confidentiality and integrity of all accessible data. The vulnerability's scope change means additional Oracle products may also be significantly impacted. There is no impact on availability. The attack requires local access with low privileges but no user interaction.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the available security patches promptly to remediate this vulnerability. Oracle recommends remaining on actively supported versions and applying patches without delay. Refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.