This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and is exploitable by an unauthenticated attacker who has access to the physical communication segment attached to the hardware where the product executes. Exploitation can lead to a complete denial of service through hangs or repeated crashes, as well as unauthorized modification of data via update, insert, or delete operations. The CVSS vector indicates the attack requires adjacent network access (AV:A), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and high availability impact (A:H). Oracle has published a Critical Security Patch Update including fixes for this and other vulnerabilities.

Successful exploitation can cause Oracle Hyperion Financial Management to hang or crash repeatedly, resulting in a complete denial of service. Additionally, attackers can gain unauthorized ability to update, insert, or delete some accessible data, impacting data integrity and availability. Confidentiality is not affected according to the CVSS vector.

Oracle has released a Critical Security Patch Update that addresses this vulnerability among others. Customers are strongly advised to apply the security patches promptly to mitigate the risk. The vendor advisory emphasizes staying on actively supported versions and applying patches without delay. Patch status is confirmed by the vendor advisory, indicating that an official fix is available.