This vulnerability affects Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. An attacker who can access the physical communication segment attached to the hardware where the product executes can exploit this flaw without authentication to compromise the system. Successful exploitation can result in complete takeover of Oracle Hyperion Financial Management. The CVSS 3.1 vector indicates the attack requires adjacent network access (AV:A), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impacts confidentiality, integrity, and availability at a high level (C:H/I:H/A:H). Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

The vulnerability allows an unauthenticated attacker with physical network access to fully compromise Oracle Hyperion Financial Management, impacting confidentiality, integrity, and availability. This could lead to complete system takeover, unauthorized data access, and disruption of service.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Hyperion Financial Management version 11.2.26.0.000 should apply the relevant patch promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks.