EUVD-2026-79796
GHSA-9h6j-x65c-xfv5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network HTTP with low complexity and a required low-privilege account (PR:L); confidentiality-only full data disclosure (C:H, I:N, A:N) with scope change to adjacent products (S:C).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. While the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
AnalysisAI
Oracle Hyperion Data Relationship Management 11.2.26.0.000 allows an authenticated low-privileged attacker with network HTTP access to bypass access controls in the 'Access and security' component and read critical data, up to and including everything the affected DRM instance can reach, with no user interaction required. The impact is confidentiality-only (CVSS 3.1 7.7, C:H/I:N/A:N) but carries a scope change (S:C), meaning the data exposed can extend beyond DRM into additional integrated Oracle products. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid low-privileged account on Oracle Hyperion Data Relationship Management 11.2.26.0.000 with network HTTP access to the Access and security component; no user interaction is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix from Oracle's Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html (patch available per vendor advisory; the input data does not specify an exact patched build number, so confirm the fixed version in the advisory before upgrading) and verify the installed DRM build after upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Hyperion Data Relationship Management 11.2.26.0.000 deployment and map which of them are network-reachable over HTTP; restrict access to trusted management networks or place DRM behind a VPN/zero-trust proxy, and audit and reduce the population of low-privileged DRM accounts to the minimum necessary, disabling or re-scoping any dormant or broad-read accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today