This vulnerability affects Oracle Hyperion Financial Management component Security in version 11.2.26.0.000. It is exploitable remotely over HTTP by an attacker with low privileges, enabling compromise of the product and potentially full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for this version in the excerpt provided.

Successful exploitation can lead to complete compromise of Oracle Hyperion Financial Management, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected system, potentially leading to unauthorized data access, modification, or disruption of service.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The September 2026 Critical Security Patch Update advisory references this vulnerability, implying that a patch is likely included in the update. However, explicit patch availability for version 11.2.26.0.000 is not confirmed in the provided advisory excerpt. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html for detailed patching instructions and verify patch availability for their specific version. Until patched, restrict network access to the affected service where possible.