This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security weakness in the product's security component. An unauthenticated attacker who has logon access to the infrastructure where the product runs can exploit this issue, but exploitation is difficult and requires human interaction from a third party. The impact is limited to unauthorized modification (update, insert, delete) of some accessible data. The CVSS 3.1 base score is 2.5, reflecting low severity with integrity impact only and no confidentiality or availability impact.

The vulnerability allows unauthorized modification of some data within Oracle Hyperion Financial Management by an attacker with infrastructure logon access and requiring human interaction. There is no impact on confidentiality or availability. The low CVSS score and the requirement for human interaction and infrastructure access limit the risk.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly. Since this is not a cloud service, remediation depends on applying Oracle's patches to affected installations. Patch status is confirmed by Oracle's advisory. No alternative mitigations are specified.