This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 in the security component. It requires an attacker to have low privileged logon access to the infrastructure hosting the product. Exploitation can lead to a full takeover of the Oracle Hyperion Financial Management environment. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the attack vector is local, attack complexity is high, privileges required are low, no user interaction is needed, and the impact on confidentiality, integrity, and availability is high.

Successful exploitation can result in complete compromise of Oracle Hyperion Financial Management, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the application and potentially disrupt financial management operations.

Oracle has released this vulnerability as part of its September 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. Oracle recommends staying on actively supported versions and applying patches without delay. Patch availability and installation instructions can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html. No alternative mitigations or workarounds are specified.