This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and involves a security flaw in the product's security component. An attacker with high privileges and logon access to the underlying infrastructure can exploit this issue to gain unauthorized read and write access to certain data within the application. The CVSS 3.1 vector indicates the attack requires local access (AV:L), high attack complexity (AC:H), high privileges (PR:H), no user interaction (UI:N), unchanged scope (S:U), and results in low confidentiality and integrity impacts (C:L, I:L) with no availability impact (A:N).

The impact includes unauthorized read access and unauthorized modification (update, insert, delete) of some data accessible by Oracle Hyperion Financial Management. The vulnerability requires the attacker to have high privileges and logon access to the infrastructure, limiting the attack surface. There is no reported impact on availability. The overall severity is low.

Oracle strongly recommends applying the security patches provided in their Critical Security Patch Update (CSPU) for August 2026. Customers should remain on actively supported versions and apply patches without delay to mitigate this vulnerability. The vendor advisory does not indicate that the vulnerability is already mitigated or that no action is required. Patch availability is implied by the CSPU, but no direct patch link is provided in the input. Check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and installation instructions.