EUVD-2026-79788
GHSA-8p37-3qm7-m2mv
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Network HTTP with low complexity, but requires high-privilege access (PR:H); scope change per Oracle, full confidentiality read, only partial integrity, no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. While the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N).
AnalysisAI
Oracle Hyperion Data Relationship Management 11.2.26.0.000 lets a high-privileged, network-positioned user defeat the Access and security component and reach well beyond their intended authorization boundary - reading critical master data and gaining update/insert/delete capability over data they should not control. Exploitation is low-complexity (AC:L) and requires no user interaction (UI:N), but it is gated behind a pre-existing high-privilege account on the DRM instance (PR:H), and because the vector carries a scope change (S:C), success can cascade into connected EPM and finance systems that trust DRM as a source of record. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold HIGH privileges (PR:H) on an affected Oracle Hyperion Data Relationship Management 11.2.26.0.000 instance and network HTTP access to its Access and security component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a well-calibrated 7.6 (High, not Critical), and the CVSS vector is the primary decision driver since every other exploitation signal is absent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: apply the Oracle Critical Patch Update covering Oracle Hyperion Data Relationship Management at https://www.oracle.com/security-alerts/cspusep2026.html, which is the authoritative source for the applicable fixed build on the 11.2.26.x line - the supplied data does not name an exact patched version number, so confirm the CPU build against your installed 11.2.26.0.000 deployment before treating the finding as closed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Oracle Hyperion Data Relationship Management instance at version 11.2.26.0.000, confirm which environments are reachable from general user or partner networks, and open a support case with Oracle to request a patch timeline or one-off fix; simultaneously pull a list of all accounts holding elevated privileges on those DRM instances and confirm each one is still required for a named business function. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today