This vulnerability affects Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It permits an unauthenticated attacker with network access over HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates that the attack requires no privileges or user interaction and can be performed remotely with low complexity, impacting confidentiality severely but not integrity or availability. The vulnerability was publicly disclosed with a high severity score of 7.5. Oracle's September 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for this exact version in the supplied text.

Successful exploitation allows an unauthenticated remote attacker to access critical or all data accessible by Oracle Hyperion Financial Management 11.2.26.0.000, compromising confidentiality. There is no indication of impact on integrity or availability. This could lead to unauthorized disclosure of sensitive financial management data.

Oracle's September 2026 Critical Security Patch Update advisory recommends applying security patches promptly to address vulnerabilities including this one. Although the advisory covers many products and versions, it does not explicitly confirm a patch for Oracle Hyperion Financial Management 11.2.26.0.000 in the provided content. Therefore, users should consult the official Oracle advisory and patch documentation at https://www.oracle.com/security-alerts/cspusep2026.html for the latest patch availability and apply updates without delay. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.