The vulnerability exists in the Security component of Oracle Hyperion Financial Management version 11.2.25.0.000. An unauthenticated attacker who can physically reach the hardware and its communication segment may compromise the system, allowing unauthorized creation, deletion, or modification of critical data as well as unrestricted access to all data stored by the application. This results in direct losses to confidentiality and integrity, as reflected by the CVSS 3.1 base score of 6.8 and its vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Oracle Corporation’s Hyperion Financial Management product is affected, specifically the 11.2.25.0.000 release. No other versions are mentioned by the CNA.

With a CVSS score of 6.8 the severity is moderate, and an EPSS of less than 1% indicates a very low probability of exploitation. The requirement for physical access to the server hardware further reduces the likelihood in environments with strict physical security controls. However, once accessed, the attacker can fully compromise data integrity and confidentiality, so the vulnerability should be remediated promptly. The vulnerability is not listed in CISA’s KEV catalog, but that does not alter the risk of a local attacker breaching physical security.