This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. It allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical data or complete access to all accessible data within Oracle Hyperion Financial Management. Additionally, the attacker can perform unauthorized data modification operations such as update, insert, or delete on some accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation can lead to unauthorized access to critical and all accessible data in Oracle Hyperion Financial Management, as well as unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the affected system's data, potentially exposing sensitive financial information and allowing data tampering.

Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches without delay to remediate this vulnerability. The vendor advisory emphasizes the importance of remaining on actively-supported versions and promptly applying security patches. Patch status is confirmed as available via Oracle's Critical Security Patch Update advisory.