This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via SQL can exploit this difficult-to-exploit vulnerability to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Financial Management. The CVSS 3.1 base score is 7.4, reflecting high confidentiality and integrity impacts with no impact on availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple Oracle products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, as well as unauthorized access to all data accessible by the product. This compromises the confidentiality and integrity of sensitive financial data but does not impact system availability. The vulnerability requires network access and is difficult to exploit, and no known exploits are reported in the wild at this time.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the relevant patches from this update promptly to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the September 2026 Critical Security Patch Update. No alternative mitigations or workarounds are specified.