This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the system, potentially resulting in full takeover. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous patches including for this product version.

Successful exploitation can lead to complete takeover of Oracle Hyperion Financial Management 11.2.26.0.000, impacting confidentiality, integrity, and availability of the system. The vulnerability requires network access via HTTP and low privileges, but has high attack complexity, making exploitation difficult. There are no known exploits in the wild at this time.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Hyperion Financial Management 11.2.26.0.000 should apply the relevant patches promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities. Patch status is confirmed by the vendor advisory.