This vulnerability affects Oracle Hyperion Data Relationship Management component 'Access and security' in version 11.2.26.0.000. It is easily exploitable by an attacker with low privileges and network access over HTTP, allowing compromise of the product and unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no integrity or availability impact. The vulnerability may also affect other Oracle products due to scope change. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability.

Successful exploitation can lead to unauthorized access to critical or all data accessible via Oracle Hyperion Data Relationship Management. The confidentiality of sensitive information is severely impacted. There is no direct impact on integrity or availability. The vulnerability's scope change suggests potential indirect effects on other Oracle products.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. Patch status is confirmed by the vendor advisory. No indication of alternative mitigations or 'no action required' is provided.