This vulnerability affects Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure hosting the product. The vulnerability allows complete compromise of Oracle Hyperion Financial Management, with potential scope change affecting other Oracle products. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability.

Successful exploitation results in full takeover of Oracle Hyperion Financial Management, compromising confidentiality, integrity, and availability of the product. The vulnerability's scope change means that additional Oracle products may also be significantly impacted. This can lead to severe operational and security consequences for affected environments.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.