This vulnerability affects Oracle Hyperion Data Relationship Management (version 11.2.26.0.000) in the Access and Security component. It requires a high privilege attacker with network access via HTTP to exploit. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within Oracle Hyperion Data Relationship Management. The vulnerability has a CVSS 3.1 score of 7.7 with vector AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, high attack complexity, high privileges required, no user interaction, scope change, and high confidentiality and integrity impacts. The vendor advisory is part of Oracle's September 2026 Critical Security Patch Update, which includes patches for this and many other vulnerabilities.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Data Relationship Management. It may also allow unauthorized access to all data accessible by the product. The vulnerability affects confidentiality and integrity of data but does not impact availability. Additionally, the vulnerability's scope change means it could affect other Oracle products indirectly.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the vendor advisory. No indication of temporary fixes or workarounds is provided, so patching is the primary mitigation.