This vulnerability affects Oracle Hyperion Data Relationship Management component 'Access and security' in version 11.2.26.0.000. It is exploitable remotely over the network with low attacker privileges and requires user interaction. The scope of impact extends beyond the immediate product, potentially affecting additional Oracle products. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability.

Exploitation can result in unauthorized access to critical data within Oracle Hyperion Data Relationship Management and unauthorized update, insert, or delete operations on some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that other Oracle products may also be impacted indirectly. No known exploits in the wild have been reported to date.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official patch from Oracle promptly to remediate the issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.