This vulnerability affects Oracle Hyperion Data Relationship Management 11.2.26.0.000 in the Access and Security component. An unauthenticated attacker with network access via SOAP can exploit this flaw to cause the application to hang or repeatedly crash, resulting in a complete denial of service. The CVSS 3.1 base score is 7.5, reflecting a high impact on availability with no impact on confidentiality or integrity. The vulnerability is publicly known and documented in Oracle's September 2026 Critical Security Patch Update advisory.

Successful exploitation results in unauthorized denial of service by causing the Oracle Hyperion Data Relationship Management application to hang or crash frequently. There is no impact on confidentiality or integrity of data. The attack requires network access and does not require authentication.

Oracle has included this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to remediate this issue. The vendor advisory emphasizes the importance of staying on actively supported versions and applying patches without delay. Patch availability details are provided in the Oracle advisory. No alternative mitigations or workarounds are specified.