The vulnerability resides in the security component of Oracle Hyperion Financial Management, allowing a low‑privileged attacker with network access over HTTP to compromise the system. Successful exploitation requires a user other than the attacker to execute a request, after which the attacker can read critical financial data or gain complete access to all data the application can reach, including the ability to update, insert or delete records. The compromised confidentiality and integrity can extend beyond Hyperion through scope changes, potentially affecting other Oracle products linked to the same data.

Oracle Corporation’s Hyperion Financial Management 11.2.25.0.000 is affected. The issue is limited to the security component of that version but may propagate to other Oracle products that integrate with Hyperion via scope changes.

The CVSS 3.1 score of 7.6 reflects high severity with low access complexity and low privilege, yet a user interaction requirement mitigates immediate risk. The EPSS score of <1% indicates a very low exploitation probability at present, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would occur over an HTTP connection from a low‑privileged account, and would need the attacker to persuade another user to trigger the vulnerable request. If leveraged successfully, the attacker would gain unauthorized read or write access to financial data.