This vulnerability affects Oracle Hyperion Data Relationship Management component Access and security in version 11.2.26.0.000. It is easily exploitable by unauthenticated attackers over HTTP, enabling unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Data Relationship Management, resulting in full compromise of confidentiality and integrity of all accessible data. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the official patch promptly to remediate the issue. Oracle emphasizes remaining on actively-supported versions and applying security patches without delay. Patch status is confirmed as available via the vendor advisory. No alternative mitigations or workarounds are specified.