This vulnerability affects Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains 673 new security patches across multiple Oracle products. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Hyperion Financial Management version 11.2.26.0.000. The confidentiality of sensitive information is severely impacted, but integrity and availability are not affected according to the CVSS vector. This poses a significant risk of data breach or exposure.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability along with many others. Customers using Oracle Hyperion Financial Management version 11.2.26.0.000 should apply the official patch from this update without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.