This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. It is exploitable remotely over the network by an attacker with low privileges using SQL access, potentially allowing complete compromise of the system. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update addresses this vulnerability among many others, emphasizing the importance of applying the patch promptly.

An attacker with low privileges and network access can exploit this vulnerability to gain full control over Oracle Hyperion Financial Management 11.2.26.0.000. This compromises confidentiality, integrity, and availability of the system, potentially leading to data breaches, unauthorized modifications, and service disruption.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the patch without delay to remediate the vulnerability. Oracle emphasizes staying on actively supported versions and promptly applying security patches to prevent exploitation. Patch status is confirmed by the vendor advisory.