This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and allows unauthenticated remote attackers to compromise the application via HTTP. Exploitation can result in unauthorized modification of critical data or denial of service through system hangs or crashes. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, and impacts on integrity and availability but not confidentiality. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

An attacker can remotely and without authentication manipulate critical data within Oracle Hyperion Financial Management or cause the application to hang or crash repeatedly, leading to denial of service. This compromises data integrity and system availability but does not affect confidentiality according to the CVSS vector.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.