This vulnerability affects Oracle Hyperion Financial Management (component: Security) version 11.2.25.0.000. It allows a high-privileged attacker with existing logon access to the infrastructure hosting the product to compromise it, resulting in unauthorized read and write access to some data. The CVSS 3.1 base score is 3.0, reflecting low confidentiality and integrity impacts, no availability impact, and requiring local attack vector with high attack complexity and privileges. No vendor advisory explicitly confirms a patch or fix for this specific vulnerability, but Oracle's August 2026 Critical Security Patch Update advisory recommends applying available patches promptly. No known exploits in the wild have been reported.

An attacker with high privileges and logon access to the infrastructure can gain unauthorized read and write access to some data in Oracle Hyperion Financial Management. This could lead to data confidentiality and integrity issues but does not affect system availability. The vulnerability is considered difficult to exploit and has a low overall severity.

Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. Although no specific patch for CVE-2026-71144 is explicitly confirmed in the advisory, the August 2026 Critical Security Patch Update contains numerous fixes and should be applied promptly to mitigate this and other vulnerabilities. No vendor advisory states that no action is required or that the issue is already mitigated.