This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and allows an unauthenticated attacker with network access via TCP to gain unauthorized access to critical data. Successful exploitation can lead to unauthorized creation, deletion, or modification of all accessible data within the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. The vendor advisory references a Critical Security Patch Update from Oracle dated September 2026, which includes security patches for multiple products including Oracle Hyperion Financial Management.

An attacker can remotely exploit this vulnerability without authentication to gain unauthorized access to critical data in Oracle Hyperion Financial Management. This includes the ability to create, delete, or modify data, potentially compromising the integrity and confidentiality of all accessible data within the affected system. There is no reported impact on availability.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html. No indication of temporary mitigations or workarounds is provided, so patching is the primary remediation.