This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and is exploitable by a low privileged attacker over the network via HTTP. The vulnerability impacts the security component of the product, allowing unauthorized access to critical data and partial unauthorized modification capabilities. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted fixes for this and other vulnerabilities.

Successful exploitation can lead to unauthorized access to critical data within Oracle Hyperion Financial Management and unauthorized update, insertion, or deletion of some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that attacks may also affect additional Oracle products beyond Hyperion Financial Management.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Hyperion Financial Management 11.2.26.0.000 should apply the relevant patches promptly to remediate this vulnerability. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.