This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and allows an unauthenticated attacker with network access via TCP to gain unauthorized access. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Financial Management. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impacts.

An attacker exploiting this vulnerability can gain unauthorized access to critical data within Oracle Hyperion Financial Management, including the ability to create, delete, or modify data. This compromises the confidentiality and integrity of the affected system's data, potentially leading to significant business impact due to data manipulation or exposure.

Oracle has released a Critical Security Patch Update (CSPU) in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches without delay to remediate this issue. The vendor advisory emphasizes the importance of remaining on actively-supported versions and promptly applying patches to prevent exploitation.