This vulnerability affects Oracle Hyperion Data Relationship Management component 'Access and security' in version 11.2.26.0.000. It is easily exploitable remotely without authentication via HTTP, enabling attackers to compromise the system and access sensitive data. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. The vendor advisory is part of Oracle's September 2026 Critical Security Patch Update, which addresses this and many other vulnerabilities.

Successful exploitation results in unauthorized access to critical or all data accessible by Oracle Hyperion Data Relationship Management, compromising confidentiality. There is no impact on integrity or availability reported. The vulnerability can be exploited remotely without authentication, increasing risk.

Oracle has released security patches as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to remediate this vulnerability. The vendor advisory does not indicate any temporary mitigations or that no action is required. Patch status is confirmed by the vendor advisory. Users should remain on actively supported versions and apply security updates without delay.