This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. An attacker with physical access to the communication segment attached to the hardware where the software runs can exploit this flaw without authentication. The impact includes unauthorized data manipulation and access, as well as partial denial of service conditions. The CVSS vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) reflects that the attack requires adjacent network access with low complexity, no privileges, and no user interaction, resulting in high confidentiality and integrity impact and low availability impact. Oracle has addressed this vulnerability in the September 2026 Critical Security Patch Update, which contains numerous patches across Oracle products.

The vulnerability allows an unauthenticated attacker with physical network access to compromise Oracle Hyperion Financial Management 11.2.26.0.000. This can lead to unauthorized creation, deletion, or modification of critical data, unauthorized access to all data accessible by the product, and partial denial of service. The confidentiality and integrity impacts are high, while availability impact is low. There are no known exploits in the wild at this time.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Hyperion Financial Management 11.2.26.0.000 should apply the relevant patches promptly to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No additional mitigations are specified beyond applying the official patch.