This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and is exploitable remotely over the network via HTTP by an attacker with low privileges. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Hyperion Financial Management. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted security fixes including this issue.

Exploitation of this vulnerability can lead to unauthorized access and modification of critical data within Oracle Hyperion Financial Management, compromising data confidentiality and integrity. This could allow an attacker to manipulate or delete sensitive financial data, potentially causing significant operational and reputational damage. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

Oracle has released a security patch for this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply this patch promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.