This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. An attacker who can access the physical communication segment of the hardware where the software runs can exploit this flaw without authentication. The impact includes unauthorized modification of critical data and the ability to cause a hang or repeated crashes, resulting in denial of service. The CVSS 3.1 base score is 8.1, reflecting high impact on integrity and availability with attack vector requiring adjacent network access and no privileges or user interaction needed.

The vulnerability allows unauthorized attackers with physical network access to create, delete, or modify critical data within Oracle Hyperion Financial Management, compromising data integrity. It also enables attackers to cause the application to hang or crash repeatedly, leading to denial of service and impacting availability.

Oracle has released this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to remediate this issue. The vendor advisory emphasizes the importance of staying on actively supported versions and applying patches without delay. Patch availability for Oracle Hyperion Financial Management 11.2.26.0.000 is indicated in the advisory. No alternative mitigations or workarounds are specified.