The vulnerability presents as an improper access control flaw that permits a high privileged attacker who has local access to the infrastructure hosting Oracle Planning and Budgeting Cloud Service to read or manipulate critical data, or to assume full control of the service. The flaw is contiguous to the EPM Agent component of Oracle Hyperion. Because it is logged in and requires human interaction to trigger, the attack is not fully automated. The result can range from unauthorized data access to a complete compromise of all data available through the service.

The affected product is Oracle Planning and Budgeting Cloud Service from Oracle Corporation, version 25.04.07. The vulnerability resides in the EPM Agent component of the service. No other versions are currently reported as affected.

The CVSS 3.1 Base Score is 4.2, indicating a medium confidentiality impact with no integrity or availability effect. The EPSS score is less than 1 %, suggesting a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers need local, high‑privilege access to the underlying infrastructure and additional human interaction to execute the exploit, so the risk is moderate in environments where privileged access is tightly controlled.