This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. An attacker without authentication but with network access via HTTP can exploit this flaw to gain unauthorized capabilities to create, delete, or modify critical data within the system. Additionally, the attacker can cause a partial denial of service, impacting the availability of Oracle Hyperion Financial Management. The CVSS 3.1 vector indicates the attack requires no privileges or user interaction and can be performed remotely with low complexity.

Successful exploitation results in unauthorized modification of critical data or all accessible data in Oracle Hyperion Financial Management, compromising data integrity. It also allows the attacker to cause a partial denial of service, affecting system availability. Confidentiality is not impacted according to the CVSS vector.

Oracle has released security patches as part of its September 2026 Critical Security Patch Update, which includes fixes for this vulnerability. Customers are strongly advised to apply the relevant patches without delay to remediate this issue. The vendor advisory emphasizes staying on actively supported versions and promptly applying security patches to prevent exploitation. Patch status is confirmed as available via Oracle's Critical Security Patch Update.