This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An attacker with low privileges and logon access to the infrastructure can exploit this vulnerability to gain unauthorized access, enabling them to create, delete, or modify critical data or all data accessible by Oracle Hyperion Financial Management. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates that the attack requires local access with low complexity and privileges but no user interaction, impacting confidentiality and integrity at a high level without affecting availability.

The impact of this vulnerability includes unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management. It can lead to complete unauthorized access to all data accessible by the application, compromising confidentiality and integrity of sensitive financial data. There is no reported impact on availability. The vulnerability requires the attacker to have logon access to the infrastructure where the product runs.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes the importance of staying on actively supported versions and applying patches without delay. No specific workaround or temporary fix is mentioned; patching is the recommended remediation.