This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and allows an unauthenticated attacker with network access via TLS to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Financial Management. The CVSS 3.1 base score is 7.4, reflecting high confidentiality and integrity impacts with no availability impact. The vulnerability requires high attack complexity and no privileges or user interaction. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

An attacker exploiting this vulnerability can gain unauthorized access to critical data within Oracle Hyperion Financial Management, including the ability to create, delete, or modify data. This compromises the confidentiality and integrity of the affected system's data. There is no reported impact on system availability.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant security patches promptly to mitigate this risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the September 2026 Critical Security Patch Update advisory.