This vulnerability affects Oracle Hyperion Financial Management version 11.2.25.0.000. It requires an attacker to have physical access to the communication segment attached to the hardware where the software executes. The flaw allows unauthorized actors to create, delete, or modify critical data within Oracle Hyperion Financial Management. The CVSS vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates that the attack vector is adjacent network with high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

An attacker with physical access to the communication segment can compromise Oracle Hyperion Financial Management, leading to unauthorized creation, deletion, or modification of critical data. This compromises the confidentiality and integrity of the data managed by the system. There is no impact on availability. The vulnerability is rated medium severity with a CVSS score of 6.8.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to remediate this vulnerability. Since the vulnerability requires physical access to the communication segment, limiting physical access to hardware and network segments can also reduce risk. No indication from the vendor advisory suggests that no action is required or that the issue is already mitigated without patching.