This vulnerability affects Oracle Hyperion Data Relationship Management component 'Access and security' in version 11.2.26.0.000. It enables a low privileged attacker with network access via HTTP to compromise the product, requiring user interaction from a third party. Successful exploitation can lead to unauthorized access to critical data or unauthorized update, insert, or delete operations on accessible data. The vulnerability also has scope change implications, potentially affecting other Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, required user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Data Relationship Management. It can also allow unauthorized modification (update, insert, delete) of some accessible data. The vulnerability's scope change means it may significantly impact additional Oracle products beyond Hyperion Data Relationship Management.

Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate the risk. The vendor advisory emphasizes staying on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the Oracle Critical Security Patch Update advisory.