This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP can exploit this flaw to compromise the system, resulting in unauthorized access to critical data or complete access to all accessible data within Oracle Hyperion Financial Management. Additionally, the attacker may gain unauthorized capabilities to update, insert, or delete some of the accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation of this vulnerability can lead to unauthorized access to critical and potentially all accessible data within Oracle Hyperion Financial Management. It also allows unauthorized modification actions such as update, insert, or delete on some data, compromising data integrity. There is no reported impact on availability. The vulnerability poses a high risk to confidentiality and a lower but significant risk to data integrity.

Oracle has released a security patch addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patch promptly to mitigate the risk. Oracle emphasizes remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.