This vulnerability affects Oracle Hyperion Financial Management version 11.2.25.0.000 in the security component. It is difficult to exploit and requires a high privileged attacker with existing logon access to the infrastructure hosting the product. If exploited successfully, it can result in complete takeover of the Oracle Hyperion Financial Management application. The CVSS 3.1 vector indicates local attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An attacker with high privileges and logon access to the infrastructure can compromise Oracle Hyperion Financial Management, potentially leading to full control over the application. This impacts confidentiality, integrity, and availability of the system. There are no reports of known exploits in the wild.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 which includes fixes for this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly. No indication was given that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, remediation depends on applying the vendor's patches. Patch status is confirmed by the vendor advisory linked.