This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and is exploitable remotely without authentication via HTTP. Successful exploitation can lead to unauthorized access to critical data and partial unauthorized modification capabilities. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low integrity impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products, including Oracle Hyperion Financial Management.

An unauthenticated attacker with network access can compromise Oracle Hyperion Financial Management, resulting in unauthorized access to critical data or complete access to all accessible data. Additionally, the attacker can perform unauthorized update, insert, or delete operations on some data. This compromises confidentiality and integrity of the affected system's data, potentially leading to data breaches or data manipulation.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches without delay to mitigate this vulnerability. Oracle recommends remaining on actively-supported versions and promptly applying security updates. Patch status is confirmed as available via the Oracle advisory.