This vulnerability affects Oracle Hyperion Financial Management 11.2.26.0.000 and involves a security flaw in the product's security component. It can be exploited remotely over the network via HTTP by an attacker with low privileges, but requires user interaction from a third party. The vulnerability has a scope change, potentially impacting additional Oracle products beyond Hyperion Financial Management. Successful exploitation can result in unauthorized access to critical data or full access to all data accessible by the product, as well as unauthorized modification (update, insert, delete) of some data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, required user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update and strongly recommends applying patches promptly.

Exploitation of this vulnerability can lead to unauthorized access to critical and sensitive data within Oracle Hyperion Financial Management, including the ability to read all accessible data and to modify some data through update, insert, or delete operations. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that other Oracle products integrated or related to Hyperion Financial Management may also be affected indirectly.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided security patches without delay to mitigate the risk. Oracle recommends remaining on actively supported versions and promptly applying all relevant patches. No indication of alternative mitigations or 'no action required' was provided, so patching is the primary remediation.