The vulnerability exposes a remote method invocation (RMI) endpoint that accepts connections without authentication, allowing an attacker to perform unauthorized creation, deletion or modification of critical data within Oracle Hyperion Financial Reporting. The lack of proper access control on the RMI interface results in high confidentiality and integrity impact, as reflected in its CVSS 3.1 Base Score of 9.1.

The affected system is Oracle Hyperion Financial Reporting version 11.2.25.0.000, distributed by Oracle Corporation. This specific build is identified as vulnerable; no other versions or products are listed as impacted.

The CVSS score of 9.1 indicates a high severity, and the vulnerability can be exercised by any threat actor with network reach to the RMI port, requiring no credentials. Although no EPSS data or KEV listing is available, the nature of the flaw suggests that exploitation is straightforward and could be widespread if it remains unpatched. The attack vector is through standard RMI network communication, presenting a large attack surface for unauthenticated actors.