This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and is exploitable remotely without authentication over HTTP. Successful exploitation results in unauthorized access to sensitive data managed by the product. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the attack requires network access, has low attack complexity, no privileges or user interaction, and impacts confidentiality with high severity but does not affect integrity or availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update advisory, which addresses numerous security issues across Oracle products.

An attacker can remotely access critical or all data accessible through Oracle Hyperion Financial Management without authentication, leading to a breach of confidentiality. There is no impact on integrity or availability according to the CVSS vector. This could result in exposure of sensitive financial management data.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant patches promptly to remediate this issue. The vendor advisory emphasizes the importance of staying on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the Oracle Critical Security Patch Update.