This vulnerability affects Oracle Hyperion Financial Management version 11.2.25.0.000 in the Security component. It is difficult to exploit and requires a low privileged attacker with logon access to the infrastructure and human interaction from a third party. The impact includes unauthorized ability to read, update, insert, or delete some accessible data and cause a partial denial of service. The CVSS vector is AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L, reflecting local attack vector, high attack complexity, low privileges required, user interaction required, unchanged scope, and low confidentiality, integrity, and availability impacts.

The vulnerability allows unauthorized partial compromise of Oracle Hyperion Financial Management data and functionality, including unauthorized read and modification of some accessible data and partial denial of service. The attack complexity is high and requires user interaction, limiting the ease of exploitation. The overall impact is medium severity with low confidentiality, integrity, and availability impacts.

Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory. However, no explicit patch link or fixed version is provided in the input data. Customers are strongly recommended to apply Oracle's Critical Security Patch Updates promptly and remain on actively supported versions. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.