This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and is exploitable remotely over HTTP without authentication. Successful exploitation results in unauthorized access to critical or complete data within the affected system. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with no integrity or availability impact. Oracle has published a Critical Security Patch Update advisory referencing this vulnerability, recommending patching to remediate the issue.

An attacker can remotely access sensitive data in Oracle Hyperion Financial Management without authentication, potentially compromising confidentiality of critical financial data. There is no impact on data integrity or availability reported. This could lead to unauthorized disclosure of sensitive information.

Oracle has released security patches addressing this vulnerability as part of their September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. No indication was given that the vulnerability is already mitigated or requires no action. Patch status is confirmed by the vendor advisory. Users should remain on actively supported versions and apply Oracle patches without delay.