This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An attacker who can access the physical communication segment attached to the hardware where the software executes can exploit this flaw without authentication. The impact includes unauthorized creation, deletion, or modification of critical data and unauthorized access to all data accessible by the product. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The attack vector is adjacent network (AV:A), requiring no privileges or user interaction.

Exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive financial management data but does not affect availability.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update process. However, the provided vendor advisory does not explicitly state that a patch for this specific vulnerability is currently available. Therefore, patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Customers should ensure they are running actively supported versions and apply any relevant patches without delay once available.