This vulnerability affects Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. An unauthenticated attacker with access to the physical communication segment of the hardware where the product executes can exploit this flaw to gain unauthorized access, including creation, deletion, or modification of critical data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts. The attack vector requires adjacent network access (AV:A), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The vulnerability does not impact availability.

Exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Financial Management. This compromises confidentiality and integrity of sensitive financial management data, potentially leading to significant business impact.

Oracle has released this vulnerability as part of its September 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly to remediate this vulnerability. The vendor advisory emphasizes the importance of staying on actively supported versions and applying patches without delay. Patch availability and installation instructions can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html. No alternative mitigations or workarounds are specified.