This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and allows an unauthenticated attacker with network access via HTTP to gain unauthorized access that can result in creation, deletion, or modification of critical data. The vulnerability impacts confidentiality and integrity with a CVSS 3.1 score of 10.0. Oracle's September 2026 Critical Security Patch Update addresses this vulnerability among 673 patches released across multiple Oracle products. Oracle strongly recommends applying these patches without delay to prevent exploitation. The vulnerability may also impact additional Oracle products due to scope change.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, resulting in complete compromise of confidentiality and integrity of accessible data. This can significantly disrupt business operations relying on the affected product. There is no indication of impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers should apply the security patches provided in this update promptly. Oracle strongly recommends remaining on actively supported versions and applying all relevant patches without delay to mitigate the risk of exploitation. No additional mitigation steps are indicated beyond patching.