This vulnerability affects Oracle Hyperion Financial Management version 11.2.26.0.000 and involves a security flaw in the product's security component. An attacker with low privileges but physical access to the communication segment of the hardware can exploit this flaw to compromise the system, resulting in full control over Oracle Hyperion Financial Management. The CVSS 3.1 vector indicates the attack requires adjacent network access (AV:A), low attack complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), and results in high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update advisory, which strongly recommends applying patches promptly.

Successful exploitation allows an attacker with low privileges and physical access to the communication segment to take over Oracle Hyperion Financial Management, compromising confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, modification, or disruption of financial management operations.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches without delay to mitigate this vulnerability. Staying on actively supported versions and promptly applying Oracle patches is critical, as Oracle reports ongoing attempts to exploit vulnerabilities for which patches exist. No alternative mitigations or workarounds are specified in the advisory.