This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. An attacker who can access the physical communication segment attached to the hardware where the software executes can exploit this vulnerability without authentication. Exploitation results in unauthorized access allowing creation, deletion, or modification of critical data within the system. The CVSS vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates the attack requires adjacent network access with low complexity, no privileges, and no user interaction, impacting confidentiality and integrity severely but not availability. Oracle has published a Critical Security Patch Update advisory referencing this vulnerability, emphasizing the importance of applying patches promptly.

The vulnerability allows unauthorized attackers with physical network segment access to compromise Oracle Hyperion Financial Management, leading to unauthorized creation, deletion, or modification of critical data. This results in a high impact on confidentiality and integrity of the data managed by the product. There is no reported impact on availability. No known exploits in the wild have been reported to date.

Oracle strongly recommends applying the security patches provided in their Critical Security Patch Update (CSPU) released in September 2026. Customers should remain on actively supported versions and apply patches without delay to mitigate this vulnerability. Since the vulnerability requires physical access to the communication segment, limiting such access can reduce risk. Patch status is confirmed by Oracle's advisory; therefore, applying the official patch is the primary mitigation.