This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and is classified under the security component. It requires a high level of attacker privileges and local access (AV:L, PR:H) and is difficult to exploit (AC:H). Successful exploitation results in a complete compromise of the product, impacting confidentiality, integrity, and availability (CVSS 3.1 score 7.5). The vulnerability also has a scope change, meaning it can affect other Oracle products beyond Hyperion Financial Management. The vendor advisory is part of Oracle's August 2026 Critical Security Patch Update, which includes numerous patches across Oracle products.

Successful exploitation allows a high privileged attacker with local access to take over Oracle Hyperion Financial Management, resulting in full compromise of confidentiality, integrity, and availability of the product. Due to scope change, other Oracle products may also be significantly impacted.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate this vulnerability. The vendor advisory emphasizes the importance of staying on actively-supported versions and applying patches without delay. Patch availability details can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.