This vulnerability affects Oracle Hyperion Data Relationship Management (component: Access and security) version 11.2.26.0.000. An unauthenticated attacker with network access via HTTPS can exploit the flaw, but exploitation requires user interaction from a third party. Successful exploitation can lead to unauthorized modification, creation, or deletion of critical data within the product and cause a partial denial of service. The CVSS 3.1 base score is 7.1, reflecting high impact on integrity and low impact on availability, with no confidentiality impact. The vulnerability is publicly known and documented by Oracle.

The vulnerability allows unauthorized modification of critical data and partial denial of service in Oracle Hyperion Data Relationship Management. There is no impact on confidentiality. Exploitation requires user interaction from someone other than the attacker, which limits the attack vector. No known exploits in the wild have been reported.

Oracle has released security patches as part of their September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this vulnerability. The vendor advisory emphasizes the importance of staying on actively supported versions and applying patches without delay. Patch status is confirmed by the vendor advisory indicating that fixes are available in the Critical Security Patch Update.