This vulnerability affects Oracle Hyperion Financial Management version 11.2.26.0.000 and involves a security flaw in the product's security component. It allows a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical data or complete access to all accessible data. Additionally, the attacker can perform unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation can lead to unauthorized access to critical and all accessible data within Oracle Hyperion Financial Management, as well as unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the data managed by the product.

Oracle has released a Critical Security Patch Update (CSPU) in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes the importance of remaining on actively-supported versions and applying patches without delay. Patch status is confirmed as available via the Oracle CSPU advisory.