This vulnerability affects Oracle Hyperion Data Relationship Management component Access and security in version 11.2.26.0.000. It is exploitable remotely over the network with low attack complexity and requires low privileges and user interaction from someone other than the attacker. The vulnerability results in a scope change affecting additional Oracle products and can lead to unauthorized access and modification of critical data. The CVSS vector indicates network attack vector, low complexity, low privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Data Relationship Management. It also allows unauthorized update, insert, or delete operations on some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change means that other Oracle products may also be impacted by attacks exploiting this vulnerability.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Hyperion Data Relationship Management version 11.2.26.0.000 should apply the provided patches without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are indicated in the advisory.