This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP can exploit this flaw to gain unauthorized access, enabling creation, deletion, or modification of critical or accessible data, and unauthorized reading of a subset of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality impact but high integrity impact and no availability impact. Oracle has published a Critical Security Patch Update advisory recommending patch application to address this and other vulnerabilities.

The vulnerability allows an unauthenticated remote attacker to compromise Oracle Hyperion Financial Management, potentially resulting in unauthorized creation, deletion, or modification of critical data or all accessible data, and unauthorized read access to some accessible data. This can lead to significant data integrity and confidentiality breaches within affected deployments.

Oracle has released a Critical Security Patch Update that addresses this vulnerability among others. Customers are strongly advised to apply the relevant security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via Oracle's Critical Security Patch Update advisory.