This vulnerability affects Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It is exploitable by an attacker with low privileges who has logon access to the infrastructure where the product runs. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, and may also impact additional Oracle products due to scope change. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality and integrity impact, and no availability impact.

The vulnerability allows unauthorized modification and access to critical data within Oracle Hyperion Financial Management, potentially compromising confidentiality and integrity of sensitive financial data. Due to scope change, other Oracle products may also be significantly impacted. There is no reported impact on availability. No known exploits in the wild have been reported.

Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the Oracle Critical Security Patch Update advisory.