This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP can exploit this flaw, though it is considered difficult to exploit. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Hyperion Financial Management. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

The vulnerability allows unauthorized attackers to gain unauthorized creation, deletion, or modification access to critical data or complete access to all data accessible by Oracle Hyperion Financial Management. This can compromise confidentiality and integrity of sensitive financial data managed by the product. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying patches without delay. Patch status is confirmed as available via the Oracle advisory. No additional mitigation steps are specified beyond applying the official patch.