This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP could exploit this issue to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or unauthorized access to all accessible data. The CVSS 3.1 base score is 7.4, indicating high severity with high confidentiality and integrity impacts but no impact on availability. The vulnerability requires high attack complexity and no privileges or user interaction.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Hyperion Financial Management. This compromises data confidentiality and integrity but does not affect system availability.

Oracle has released security patches as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the vulnerability. The vendor advisory emphasizes the importance of staying on actively supported versions and applying security patches without delay. Patch availability details can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.