EUVD-2026-79796
GHSA-9h6j-x65c-xfv5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege DRM account
-
ExploitSend crafted HTTP request to Access/security component
-
ExecutionBypass authorization boundary
-
ImpactRead all accessible critical data across scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged account on Oracle Hyperion Data Relationship Management 11.2.26.0.000 with network HTTP access to the Access and security component; no user interaction is needed. Exploitation is limited by the authentication prerequisite (PR:L - attacker must already have credentials or a foothold account) and by the product's narrow enterprise deployment. Impact is confidentiality-only (read/disclose critical data); no data modification or service disruption is possible via this flaw. The scope change means disclosed data may extend to additional integrated Oracle products beyond DRM itself. |
| Impact | This is a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) describes a network-reachable, low-complexity attack requiring only low-privilege authentication (PR:L), yielding full confidentiality compromise (C:H, read all accessible data) with a scope change (S:C) that Oracle notes may significantly impact additional products - but no integrity or availability impact (I:N/A:N), which is why the score sits at 7.7 rather than in the 9.x range. Critically, this is NOT a pre-authentication flaw: the 'Authentication Bypass' tag in the input contradicts the PR:L vector, which explicitly requires a valid low-privileged account. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis. Oracle's advisory (cspusep2026) provides zero technical detail, consistent with all September 2026 CPU entries. Net: a real confidentiality/data-disclosure risk worth patching in the CPU cycle, but the authentication requirement, niche product footprint, and absence of exploitation signals place it below the pre-auth full-takeover CVEs in the same CPU. |
| Exploit ScenarioDerived | A user with a low-privilege account on an internet- or intranet-reachable Oracle Hyperion Data Relationship Management instance sends crafted HTTP requests to the Access and security component, exploiting a flaw that lets them read data beyond their authorization - potentially critical master-data across the EPM environment. Because of the scope change, the disclosed data may extend to additional integrated Oracle products. No public exploit code is available at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Oracle Hyperion Data Relationship Management 11.2.26.0.000 allows an authenticated low-privileged attacker with network HTTP access to bypass access controls in the 'Access and security' component and read critical data, up to and including everything the affected DRM instance can reach, with no user interaction required. The impact is confidentiality-only (CVSS 3.1 7.7, C:H/I:N/A:N) but carries a scope change (S:C), meaning the data exposed can extend beyond DRM into additional integrated Oracle products. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the low-privileged account prerequisite keeps this a genuine but moderate-priority risk for organizations running the affected release in enterprise master-data deployments.
RemediationAI
Apply the fix from Oracle's Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html (patch available per vendor advisory; the input data does not specify an exact patched build number, so confirm the fixed version in the advisory before upgrading) and verify the installed DRM build after upgrade. Where patching cannot be immediate, compensating controls should target the two prerequisites of this attack - network reachability and low-privileged accounts: restrict HTTP access to the DRM 'Access and security' endpoints to trusted administrative networks via firewall/segmentation or a reverse proxy with allow-listed source ranges (trade-off: may break browser access for distributed business users and existing integrations that call the same interfaces), and audit/curtail low-privileged DRM roles that do not need read access to critical hierarchy data, enforcing least privilege through the DRM security model (trade-off: can disrupt legitimate reporting and integration accounts and requires an entitlement review). Additionally, enable and monitor DRM access and query logging for anomalous bulk reads or exports from low-privileged principals, since the flaw is read-only and exfiltration is the only observable outcome; note that these controls reduce exposure but do not eliminate the underlying authorization bypass.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in Oracle Hyperion Data Relationship Management (DRM), Oracle's master data management product for building and governing hierarchies and dimensions used across the Hyperion/EPM stack, specifically in the 'Access and security' component and tagged as an Authentication Bypass by the reporter. Attack surface is HTTP (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), but a valid low-privileged account is required (PR:L), so the weakness is best understood as a broken authorization/access-control check that a legitimate low-privilege user can leverage to reach data their role should not permit, rather than a pre-authentication compromise. No CWE was assigned in the source data, which limits root-cause attribution; the observable behavior is an authorization failure enabling read-only disclosure of critical data. The scope change (S:C) is significant: because DRM frequently stores and propagates reference hierarchies to other Oracle/Hyperion applications and downstream consumers, a failure in DRM's own security boundary can expose data whose security authority resides in other products. The strict confidentiality-only vector (I:N/A:N) confirms there is no integrity tampering or denial-of-service component to this flaw; the attacker's objective is exfiltration of data accessible to the DRM instance, and the practical blast radius is bounded by the product's typically narrow, internal enterprise deployment and by the credential prerequisite.
Know when Hyperion Data Relationship Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network HTTP with low complexity and a required low-privilege account (PR:L); confidentiality-only full data disclosure (C:H, I:N, A:N) with scope change to adjacent products (S:C).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. While the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Executive ViewAI
A high-severity confidentiality flaw in Oracle Hyperion Data Relationship Management 11.2.26.0.000 allows a user holding only basic, low-privileged access to sidestep the platform's access-and-security controls and read essentially any master data the DRM instance can reach - including data held in connected Oracle systems. Because this is the system of record for enterprise master data, exposure could span finance, reporting, and downstream analytics environments that trust DRM as their authoritative source, affecting data owners, finance leadership, and any business function relying on that data's integrity of access. No public exploit or confirmed active exploitation was identified at time of analysis, and no vendor patch is available, so risk management must rest on access restriction and monitoring.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network/HTTP reachability of DRM 11.2.26.0.000 to trusted segments or VPN only; minimize and review low-privileged accounts and their read grants in the Access and security component; revoke unnecessary trust relationships with downstream integrated Oracle products (scope-change risk); enable and monitor audit logging for access-control and bulk-read activity on the DRM instance; escalate to Oracle Support for a fix timeline or backport.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Rat
Complete takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by remote, unauthenticated a
Full remote takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by an unauthenticated att
Full product takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a remote, unauthent
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), th
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible when an attacker who already hol
Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Data Relationship Management version 11.2.
Unauthenticated data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a remote attacker t
Unauthorized data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security componen
Exploit-DB