This vulnerability affects the Access and Security component of Oracle Hyperion Data Relationship Management version 11.2.26.0.000. It enables a low privileged attacker with network access via HTTP to compromise the system, potentially leading to unauthorized access to critical data or full access to all data accessible by the product. Additionally, the attacker may gain unauthorized capabilities to update, insert, or delete some of the accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which customers are strongly advised to apply promptly.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Hyperion Data Relationship Management, as well as unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is exploitable remotely over the network via HTTP by an attacker with low privileges, increasing the risk of compromise if unpatched.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the relevant patches from this update without delay to remediate the issue. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.