This vulnerability affects the Access and Security component of Oracle Hyperion Data Relationship Management version 11.2.26.0.000. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data or full access to all accessible data within the product. Additionally, the attacker can perform unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which customers are strongly advised to apply promptly.

Successful exploitation can result in unauthorized access to critical and all accessible data within Oracle Hyperion Data Relationship Management, as well as unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the data managed by the product. There is no reported impact on availability. The vulnerability is rated high severity with a CVSS score of 7.1.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the relevant patches for Oracle Hyperion Data Relationship Management version 11.2.26.0.000 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No additional vendor mitigation guidance indicates that other actions are required beyond patching.