This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 in the security component. It allows a low privileged attacker with network access via HTTP to compromise the system, potentially resulting in complete takeover. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has acknowledged this vulnerability in its September 2026 Critical Security Patch Update advisory but has not explicitly detailed a specific patch for this version in the provided advisory content.

Successful exploitation can lead to full compromise of Oracle Hyperion Financial Management 11.2.26.0.000, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected system, potentially leading to unauthorized access and control.

Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. This vulnerability is included in the September 2026 Critical Security Patch Update. Customers should review the official Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html for patch availability and installation instructions. Patch status for this specific version is not explicitly confirmed in the advisory content provided; therefore, users should verify patch availability directly from Oracle. No vendor advisory states that no action is required or that the issue is already mitigated.