This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and is exploitable remotely over HTTPS by unauthenticated attackers, though it is described as difficult to exploit. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, with a scope change that may impact additional Oracle products. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, no privileges or user interaction required, scope change, and high confidentiality and integrity impacts without availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 new security patches across various Oracle products.

Exploitation of this vulnerability can lead to unauthorized access and modification of critical data within Oracle Hyperion Financial Management, potentially affecting data integrity and confidentiality. The vulnerability's scope change indicates that additional Oracle products may be impacted by attacks leveraging this flaw. There is no reported availability impact. No known exploits in the wild have been reported to date.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch status is confirmed as available via the Oracle advisory.