This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security weakness in the product's security component. An unauthenticated attacker with access to the infrastructure where the product runs can exploit this flaw, but successful exploitation requires user interaction by a third party. The vulnerability can lead to full compromise of Oracle Hyperion Financial Management, impacting confidentiality, integrity, and availability. The CVSS vector indicates local attack vector, high attack complexity, no privileges required, required user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in complete takeover of Oracle Hyperion Financial Management, affecting confidentiality, integrity, and availability of the system. However, exploitation is difficult and requires human interaction from a user other than the attacker, limiting the ease of attack.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update (CSPU), which contains targeted security fixes. Customers are strongly advised to apply the relevant patches from this update promptly. Staying on actively supported versions and applying Oracle security patches without delay is recommended. Check Oracle's official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.