This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP could exploit this issue to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Financial Management. The CVSS 3.1 base score is 7.4, reflecting high confidentiality and integrity impacts with no impact on availability. The attack complexity is high, and no privileges or user interaction are required. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides targeted security fixes across multiple products including this one.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by Oracle Hyperion Financial Management. This compromises the confidentiality and integrity of sensitive financial data managed by the product. There is no reported impact on availability. The vulnerability is rated high severity with a CVSS score of 7.4.

Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch availability and installation instructions can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html. No alternative mitigations or workarounds are specified.