This vulnerability exists in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000. It is exploitable remotely over the network by an attacker with high privileges via Oracle Net. Successful exploitation can result in complete compromise of Oracle Hyperion Financial Management, affecting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity. The scope of impact extends beyond the immediate product to other Oracle products. Oracle has acknowledged this vulnerability in its September 2026 Critical Security Patch Update advisory, which contains numerous security fixes across multiple products.

A successful attack can lead to full takeover of Oracle Hyperion Financial Management, compromising confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products may also be significantly impacted. This represents a critical risk to affected environments.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability along with many others. Customers are strongly advised to apply the relevant patches promptly to mitigate this risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html.