This vulnerability affects Oracle Hyperion Data Relationship Management (version 11.2.26.0.000) in the access and security component. It is exploitable remotely over the network with low attack complexity and requires low privileges. Successful exploitation results in a confidentiality breach with complete unauthorized access to data accessible by the product. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, low complexity, low privileges, no user interaction, scope change, high confidentiality impact, and no integrity or availability impact. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous patches across Oracle products.

Exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible by Oracle Hyperion Data Relationship Management. The confidentiality of sensitive data is compromised, but integrity and availability are not affected. The vulnerability's scope change indicates potential impact on additional Oracle products beyond the primary affected product.

Oracle has released a security patch addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply this patch promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.