This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and allows an attacker with low privileges and network access via HTTP to compromise the system. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 score of 9.9. Successful exploitation can result in complete takeover of the affected product. The vulnerability also has a scope change, meaning it may significantly impact other Oracle products. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted security fixes across multiple Oracle products.

Successful exploitation of this vulnerability can lead to full compromise of Oracle Hyperion Financial Management, including complete loss of confidentiality, integrity, and availability. The vulnerability also has a scope change, potentially affecting additional Oracle products beyond Hyperion Financial Management.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches without delay and remain on actively-supported versions. The vendor manages remediation through these official patches. Patch status is confirmed by the vendor advisory. No additional mitigation steps are specified beyond applying the official patch.