EUVD-2026-79795
GHSA-9w69-6jhg-wgh6
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reachable but requires a valid low-privileged account and non-trivial conditions, so PR:L and AC:H, with full C/I/A impact on takeover.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains a flaw in its Access and Security component that allows a low-privileged, authenticated user with HTTP network access to escalate privileges and take over the application, with high impact to confidentiality, integrity and availability. The vulnerability is rated 'difficult to exploit' by Oracle (AC:H), so successful abuse requires favorable conditions rather than a single trivial request, but the payoff is full compromise of the DRM instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated account on Oracle Hyperion Data Relationship Management 11.2.26.0.000 with low privileges (CVSS PR:L) and network reachability to the DRM application over HTTP (AV:N) - an anonymous or unauthenticated attacker cannot trigger it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable flaw that requires an existing low-privileged account and is rated high complexity, which materially narrows who can exploit it - the attacker must already be inside the DRM user base. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update for this CVE as published at https://www.oracle.com/security-alerts/cspusep2026.html - the advisory is the authoritative source for the exact patched build of Hyperion Data Relationship Management 11.2.x, and no independent fix version is confirmed in the provided data, so do not assume a specific build number without checking the CPU document. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today