This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. An attacker with network access via TLS, but without authentication, can exploit this vulnerability, which is difficult to exploit, to gain unauthorized access and perform unauthorized creation, deletion, or modification of critical or all accessible data within Oracle Hyperion Financial Management. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all accessible data in Oracle Hyperion Financial Management. This compromises confidentiality and integrity of the data but does not affect availability. The attacker does not require authentication but must have network access via TLS. The vulnerability is rated high severity with a CVSS score of 7.4.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No indication of alternative mitigations or that no action is required is provided.