This vulnerability affects Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. It is difficult to exploit but allows an unauthenticated attacker with network access via SSH to compromise the product. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Financial Management. The CVSS 3.1 base score is 7.4, reflecting high confidentiality and integrity impacts with no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for this and other vulnerabilities.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management, as well as unauthorized access to all data accessible by the product. This compromises the confidentiality and integrity of the data but does not impact availability.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate this risk. Oracle recommends staying on actively supported versions and applying patches without delay. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.