This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and is exploitable by a high privileged attacker who already has logon access to the underlying infrastructure. Successful exploitation can result in complete compromise of the Oracle Hyperion Financial Management application. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires local access with low complexity and high privileges, with no user interaction needed, and impacts confidentiality, integrity, and availability at a high level.

An attacker with high privileges on the infrastructure hosting Oracle Hyperion Financial Management can exploit this vulnerability to take over the application, potentially leading to unauthorized access, data compromise, and disruption of service. The impact affects confidentiality, integrity, and availability of the affected product.

Oracle has released this vulnerability as part of its September 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly to remediate this vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch availability and installation instructions should be obtained from Oracle's official security advisory at https://www.oracle.com/security-alerts/cspusep2026.html. No alternative mitigations or workarounds are specified.