This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and is classified under the security component. It permits a low privileged attacker who can log on to the infrastructure where the product runs to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management and may affect other Oracle products due to scope change. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management. It may also result in unauthorized access to all data accessible by the product, potentially affecting additional Oracle products due to scope change. There is no impact on availability.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. The vendor advisory does not indicate that the vulnerability is already mitigated or requires no action. Therefore, applying the official Oracle patches for Oracle Hyperion Financial Management 11.2.25.0.000 is the recommended remediation step. Patch status is confirmed by Oracle's advisory.