This vulnerability affects the Access and Security component of Oracle Hyperion Data Relationship Management version 11.2.26.0.000. An unauthenticated attacker with network access through SMTP can exploit this flaw, which is rated with a CVSS 3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the product. The vulnerability is considered difficult to exploit due to the high attack complexity. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 new security patches for various Oracle products.

The vulnerability can lead to unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Hyperion Data Relationship Management. This impacts confidentiality and integrity but does not affect availability. The attack requires network access via SMTP and is difficult to exploit, but successful exploitation could severely compromise data security within the affected product version.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant security patches promptly to mitigate this risk. Staying on actively supported versions and applying Oracle patches without delay is recommended. Patch status is confirmed as available via the September 2026 Critical Security Patch Update. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html for detailed patch availability and installation instructions.