This vulnerability affects Oracle Hyperion Financial Management version 11.2.25.0.000 and involves a security flaw that can be exploited by an attacker who already has high privileges and logon access to the infrastructure where the product runs. Exploitation can result in complete compromise of the Oracle Hyperion Financial Management environment. The CVSS 3.1 vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An attacker with high privileges and logon access to the infrastructure can exploit this vulnerability to take over Oracle Hyperion Financial Management, potentially leading to unauthorized access, data compromise, and disruption of availability.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that includes fixes for this vulnerability. Customers are strongly advised to apply the relevant security patches promptly to mitigate the risk. No indication from the vendor advisory suggests that no action is required or that the vulnerability is already mitigated without patching.