This vulnerability affects Oracle Hyperion Financial Management component Security in version 11.2.26.0.000. It is exploitable remotely over the network via HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can result in complete compromise of the Oracle Hyperion Financial Management system. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in their September 2026 Critical Security Patch Update advisory, which includes numerous security patches across Oracle products.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Hyperion Financial Management 11.2.26.0.000. This includes complete loss of confidentiality, integrity, and availability of the affected system, potentially leading to takeover of the application.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the relevant security patches from this update without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to prevent exploitation. Patch status is confirmed as available in the September 2026 Critical Security Patch Update advisory.