This vulnerability affects Oracle Hyperion Financial Management version 11.2.26.0.000 and is classified under the security component. It permits an unauthenticated attacker with network access over HTTP to compromise the system, leading to unauthorized access to sensitive data. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack can be performed remotely with low complexity, no privileges, and no user interaction, resulting in a high confidentiality impact but no integrity or availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update advisory, which contains numerous patches across multiple products. The advisory strongly recommends applying security patches promptly to mitigate risks.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Hyperion Financial Management, compromising confidentiality. There is no reported impact on integrity or availability. The vulnerability is exploitable remotely without authentication, increasing the risk of data exposure.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the relevant patches for Oracle Hyperion Financial Management version 11.2.26.0.000 without delay. Staying on actively supported versions and promptly applying Oracle patches is the recommended mitigation. Patch status is confirmed by the vendor advisory indicating that a fix is available through the Critical Security Patch Update.