This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP can exploit this flaw, but successful exploitation requires human interaction from a third party. The impact includes unauthorized modification of critical data and the ability to cause a partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) reflects network attack vector, low attack complexity, no privileges required, required user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data within Oracle Hyperion Financial Management. Additionally, it can cause a partial denial of service affecting the availability of the system. There is no confidentiality impact reported. The vulnerability requires user interaction, which limits the attacker's ability to exploit it without involving a third party.

Oracle has released a Critical Security Patch Update containing fixes for this and many other vulnerabilities. Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes staying on actively-supported versions and applying patches without delay. No indication exists that the vulnerability is already mitigated or requires no action. Patch status is confirmed by the vendor advisory recommending patch application.