This vulnerability affects Oracle Hyperion Financial Management version 11.2.25.0.000 and is related to the security component of the product. An attacker with high privileges and logon access to the underlying infrastructure can exploit this flaw to gain unauthorized access or modify critical data within Oracle Hyperion Financial Management. The CVSS vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. No known exploits are reported in the wild. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory, recommending patch application to mitigate risks.

The impact includes unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Financial Management. This compromises confidentiality and integrity of sensitive financial management data. There is no reported impact on availability. The vulnerability requires high privileges and local access to the infrastructure, limiting the attack surface to trusted users or insiders.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Since the affected product is not a cloud service, patching must be performed by the customer. No vendor advisory states that no action is required or that the issue is already mitigated without patching.