This vulnerability affects Oracle Hyperion Data Relationship Management (version 11.2.26.0.000) in the access and security component. It is exploitable by a high privileged attacker with network access over HTTP, enabling unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 base score of 7.6, reflecting high confidentiality impact and low integrity impact, with no availability impact. The vulnerability also has scope change, meaning it may affect additional Oracle products. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation can result in unauthorized access to critical data within Oracle Hyperion Data Relationship Management and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. Due to scope change, other Oracle products may also be impacted by attacks leveraging this vulnerability.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the security patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.