A flaw in the security component of Oracle Hyperion Financial Management can be exploited by a local attacker who already has logon access to the host on which the application runs. The vulnerability permits the attacker to elevate privileges within the application to full control, enabling unauthorized changes to configuration, data and processes. The CVSS 3.1 base score of 6.7 reflects the significant confidentiality, integrity and availability impact that arises when a local user can achieve high‑privilege escalation without any user interaction.

Oracle Hyperion Financial Management version 11.2.25.0.000 is the only product and version identified as vulnerable. No other editions or versions are affected.

Exploitation requires local access with high privileges, a scenario that is moderately easy for an attacker who has compromised the underlying operating system. The EPSS score of less than 1 % indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Although the CVSS score suggests moderate severity, the combination of local attack surface and the ability to compromise the entire application makes this a high‑impact risk for environments running the affected version.