This vulnerability affects Oracle Hyperion Financial Management component Security in version 11.2.26.0.000. It is easily exploitable by an attacker with low privileges and network access via HTTP, enabling compromise of the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted high-priority fixes. Customers are strongly advised to apply the patches promptly to mitigate the risk.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle Hyperion Financial Management, impacting confidentiality, integrity, and availability of the system. This could lead to complete takeover of the affected product.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches without delay to remediate this issue. Oracle strongly recommends staying on actively-supported versions and promptly applying security updates to prevent exploitation.