This vulnerability affects Oracle Hyperion Financial Management version 11.2.26.0.000 and involves a security flaw in the product's security component. It requires an attacker to have physical access to the communication segment attached to the hardware where the product executes, making exploitation difficult. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data and unauthorized access to all data accessible by the product. The CVSS vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) indicates attack vector is adjacent network, high attack complexity, no privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts with no availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 others across multiple products. Customers are urged to apply the patches without delay to mitigate risk.

The vulnerability allows unauthorized attackers with physical access to the communication segment to compromise Oracle Hyperion Financial Management, potentially resulting in unauthorized creation, deletion, or modification of critical data. It also allows unauthorized access to all data accessible by the product. The scope of impact may extend to additional Oracle products. The confidentiality and integrity of data are severely impacted, but availability is not affected. The CVSS score of 8.0 reflects a high severity level.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the provided patches promptly to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.