This vulnerability affects Oracle Hyperion Financial Management version 11.2.25.0.000 in the Security component. It allows a high privileged attacker with network access via SQL to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vendor advisory from Oracle references this vulnerability as part of the August 2026 Critical Security Patch Update but does not explicitly state patch availability for this specific CVE. Oracle strongly recommends applying security patches promptly to mitigate such vulnerabilities.

An attacker with high privileges and network access can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data or all data accessible by Oracle Hyperion Financial Management. This compromises confidentiality and integrity of the data but does not impact availability. The CVSS score of 6.5 reflects a medium severity impact.

Oracle's August 2026 Critical Security Patch Update advisory recommends that customers apply security patches without delay to mitigate vulnerabilities including this one. Although no explicit patch link is provided for CVE-2026-71091, the advisory indicates that security patches addressing vulnerabilities in Oracle Hyperion Financial Management are included in the update. Customers should verify patch availability and apply the relevant updates promptly. No vendor advisory states that no action is required or that the vulnerability is already mitigated without patching.