This vulnerability allows an attacker who has high‑privileged access to the infrastructure where the Oracle Planning and Budgeting Cloud Service (EPM Agent) runs to compromise the service, enabling unauthorized creation, deletion or modification of critical data. The weakness results in a high integrity impact but does not directly affect confidentiality or availability.

Oracle Planning and Budgeting Cloud Service – version 25.04.07. The affected component is the EPM Agent, part of Oracle Hyperion EPM. The vendor is Oracle Corporation.

The CVSS 3.1 base score is 4.2 with a low exploitation probability of <1 % according to EPSS, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires both high‑privileged infrastructure access and human interaction from a user other than the attacker, making successful attacks less likely but still feasible in environments with inadequate privilege controls.