This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. It is difficult to exploit and requires the attacker to have high privileges and logon access to the infrastructure hosting the product. Exploitation can result in unauthorized modification of accessible data (update, insert, delete) and partial denial of service conditions. The CVSS 3.1 base score is 3.0 with vector AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L, indicating local attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

An attacker with high privileges and logon access to the infrastructure can modify some accessible data in Oracle Hyperion Financial Management and cause a partial denial of service. There is no confidentiality impact reported. The impact is limited to integrity and availability with low severity.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches provided by Oracle without delay. The vendor advisory does not indicate that the vulnerability is already mitigated or requires no action. Patch availability details should be confirmed via Oracle's official security alert page. No cloud service remediation applies as this is not a cloud service.