This vulnerability affects Oracle Hyperion Financial Management version 11.2.26.0.000 and is classified under the security component. It permits a high privileged attacker with network access over HTTP to exploit the flaw, leading to complete compromise of the affected system. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation allows an attacker with high privileges and network access via HTTP to take over Oracle Hyperion Financial Management, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, modification, or service disruption.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official patch promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.