This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An attacker with low privileges and logon access to the infrastructure can exploit this flaw to cause the application to hang or crash repeatedly, resulting in a complete denial of service. The CVSS 3.1 base score is 4.7, reflecting a medium severity with an attack vector local, high attack complexity, low privileges required, no user interaction, unchanged scope, and impact limited to availability.

Successful exploitation results in unauthorized ability to cause a hang or frequent crashes of Oracle Hyperion Financial Management, leading to a complete denial of service. There is no impact on confidentiality or integrity. The attack requires local access with low privileges and is difficult to exploit.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. No indication was given that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, patching must be applied by customers following Oracle's advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.