This vulnerability in the Access and Security component of Oracle Hyperion Data Relationship Management (version 11.2.26.0.000) enables an unauthenticated attacker with network access over HTTP to compromise the system. Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some accessible data, as well as partial denial of service conditions. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted fixes for this and many other vulnerabilities.

The vulnerability allows unauthorized attackers to read and modify some data within Oracle Hyperion Data Relationship Management and cause partial denial of service. This compromises confidentiality, integrity, and availability of the affected system. The attack requires only network access via HTTP and no authentication, increasing the risk of exploitation if unpatched.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the relevant security patches promptly to mitigate this risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.