This vulnerability exists in the security component of Oracle Hyperion Financial Management 11.2.25.0.000. It is easily exploitable by an attacker with low privileges who has network access via SQL, enabling compromise of the product. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical impact on confidentiality, integrity, and availability. Successful exploitation can result in complete takeover of Oracle Hyperion Financial Management. The vulnerability may also affect other Oracle products due to scope change. Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle Hyperion Financial Management 11.2.25.0.000, resulting in complete takeover of the system. The vulnerability impacts confidentiality, integrity, and availability. Additionally, attacks may have significant impact on other Oracle products due to scope change.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available patches promptly to mitigate this risk. The vendor advisory emphasizes the importance of applying security patches without delay and remaining on actively supported versions. Patch availability details can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.