This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and is exploitable by a high privileged attacker with network access via HTTP. Successful exploitation can result in complete compromise of the affected system. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across various Oracle products. Customers are strongly advised to apply the patches promptly to mitigate this risk.

An attacker with high privileges and network access via HTTP can exploit this vulnerability to take over Oracle Hyperion Financial Management 11.2.26.0.000. This can lead to complete compromise of confidentiality, integrity, and availability of the system, potentially allowing unauthorized access, data manipulation, and service disruption.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official patch from Oracle without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.