This vulnerability affects Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update advisory.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Hyperion Financial Management and can cause a partial denial of service, impacting availability. The confidentiality impact is high, while integrity is not affected, and availability impact is low.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the security patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.