This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and is exploitable by a low privileged attacker with network access via SQL. Successful exploitation can result in complete compromise of the affected system, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.8, indicating high severity. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted security fixes for multiple Oracle products. The vendor advisory emphasizes the importance of applying patches without delay to prevent exploitation.

The vulnerability allows an attacker with low privileges and network access to execute SQL-based attacks that can lead to full system takeover of Oracle Hyperion Financial Management 11.2.26.0.000. This results in high impact on confidentiality, integrity, and availability of the system.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official patch from Oracle promptly to remediate the issue. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.