This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and allows a high privileged attacker with network access via SQL to compromise the system. The vulnerability impacts confidentiality and integrity, enabling unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management. The vulnerability also has scope change potential, meaning it may affect additional Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N with a base score of 8.7. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which customers are strongly advised to apply promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible within Oracle Hyperion Financial Management. The vulnerability affects confidentiality and integrity with no impact on availability. Due to the scope change, other Oracle products may also be significantly impacted by attacks exploiting this vulnerability.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the provided patches without delay to remediate the issue. Oracle strongly recommends staying on actively supported versions and promptly applying security patches to prevent exploitation. Patch status is confirmed as available via the Oracle advisory.