This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and allows unauthenticated remote attackers to gain unauthorized access and modify critical data via HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires no privileges or user interaction and can be performed remotely over the network, resulting in high confidentiality and integrity impacts. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches released. The vendor strongly recommends applying these patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, compromising confidentiality and integrity of all accessible data. There is no impact on availability. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise if unpatched.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed as fixed in the September 2026 Critical Security Patch Update; no additional mitigation steps are indicated beyond patching.