This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000, specifically in the security component. It is exploitable remotely over the network via HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can lead to unauthorized access to critical or all accessible data within the product and can cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability is addressed in Oracle's September 2026 Critical Security Patch Update, which includes numerous security patches across Oracle products.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical or all accessible data in Oracle Hyperion Financial Management. Additionally, the attacker can cause a partial denial of service, impacting availability. The confidentiality impact is high, while integrity is not affected, and availability impact is low. This could lead to exposure of sensitive financial data and disruption of service.

Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.